Exploit.Java.Agent.ca

Technical Details
Payload
Removal instructions

Technical Details

This Trojan exploits a vulnerability in Sun Microsystems Java (CVE-2008-5353). It has three Java class files. The files are 12 447, 3047, 3158 bytes in size.

Payload

The Trojan is designed as three class files, called:

Changes
MyBuilds
MyFiles

During its operation, the Trojan exploits vulnerability CVE-2008-5353 (CVE-2008-5353). This vulnerability arises while deserializing "Calendar" objects in Sun Java VM and enables the attacker to execute the applet with enhanced privileges. The vulnerabilities are present in Java Runtime Environment (JRE) for Sun Java Development Kit (JDK) version 6.0 up to the 10th update and earlier versions; JDK and JRE version 5.0 up to the 16th update and earlier versions; Software Development Kit and JRE 1.4.2 up to the 18th update and earlier. Once the privileges are enhanced, the exploit downloads files from the Internet from certain links. Once downloaded, the files are launched for execution. The downloaded files are saved to the current user's temporary directory as

%Temp%\<rnd>.exe

where <rnd> are random fractional decimal numbers between 0 and 1. Before downloading, it checks the name of the OS installed on the infected system. If the OS is not Windows, the download does not take place.

This malware is a Java applet. It is launched from an infected HTML page, using an "<APPLET>" tag, for which an encrypted link or downloading files is sent in parameters named "data" and "cc". The "cc" parameter determines the number of file download and launch cycle iterations. The link for downloading each file is generated as follows:

URL = data + i,

where URL is the link to download the next file; data is the value of the "data" parameter of tag "<APPLET>"; i is an integral decimal number, 0 <= i < cc; cc is the value of the "cc" parameter of tag "<APPLET>".

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Update Sun Java VM to the latest version.
2. Delete the following files:

   %Temp%\<rnd>.exe

3. Empty the Temporary Internet Files directory, which may contain infected files (see How to delete infected files from Temporary Internet Files folder?).
4. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).

MD5: B27FAF4A90CAEF7441BD0B912BB08A0A
SHA1: B2F11840E1C315D1D7BA82CA1F4FAF39B0C0098D
MD5: 8D36BDBFB548E1196E7CEA669428B2DD
SHA1: 9D49C8347E4FCE75FF34F2BB452A9A07C3439848
MD5: 63D23DA6EA900A12A0139BC5B1B56F8F
SHA1: 195F0303A1B9E22D82919BA7DFE83AD90B4565A5