Closed Manered closed 9 months ago
The L10 malware is not crypto. OpticFusion1's spigot antimalware detects it as ChestGiveaway.A (likely named by the first appearance it made to him). Its main feature is providing hidden troll commands. Although it does have code to recieve some command from the internet, I don't remember what exactly the internet connection of the malware can do, but I think it was quite limited to trolling features. Afaik the server it tries to connect to is down since at least 2 or 3 years.
You can find the other logic inside the javassist folder, it does contain classes unrelated to javassist.
It spreads to all other jar files in the plugin directory.
I do not know which obfuscator was used and I didn't search for it. Its likely some of the obfuscators available in open-source on github, a few of these popped up after superblaubeere obfuscator and the string decryption and array usage seems to be at least inspired by it.
Alright, good to know. Going to show your reply to my customer/client. They did say he had a virus or crypto-miner on his server.
Hey there, I tried deobfuscating this likely crypto-miner's class that gets injected into my customers Minecraft server (he has a crypto-miner on there, and he is trying to get rid of it). When trying to deobfuscate it with this tool, it did not print out any list of transformers (so it didn't find an appropriate deobfuscator). I'm not trying to deobfuscate the entire jar file, but just the class that the crypto-miner adds.
If you don't know how to deobfuscate this specifically, can you atleast try telling me what obfuscator was used in this process or what I can try?
Here's the class: