|Detected||Jan 17 2011 09:08 GMT|
|Released||Jan 17 2011 17:12 GMT|
|Published||Mar 25 2011 09:48 GMT|
This Trojan downloads files from the Internet and launches them without the user's knowledge. It is a Java class file. It is 7594 bytes in size.
The malware is a component of a Trojan downloader and includes a class file named "a", which downloads a file from the Internet, from a link sent to it. The file is saved in the current user's temporary files directory as
%Temp%\<rnd>.exewhere <rnd> is a random fractional decimal number from 0 to 1.
During its operation, the Trojan exploits a vulnerability in Java Runtime Environment (CVE-2010-0094). The vulnerability exists while deserializing RMIConnectionImpl objects; it enables the malicious user, outside of the virtualization environment, to call Java system functions by using ClassLoader. Java Runtime Environment (JRE) up to version 6, 18th update, is vulnerable. The Trojan constitutes a Java applet. It is launched from an infected HTML page using the "<APPLET>>" tag, for which an encrypted link to a downloadable file is sent in parameters named "trigger" and "a".
If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:
%Temporary Internet Files%
Programs classified as Trojan-Downloader download and install new versions of malicious programs, including Trojans and AdWare, on victim computers. Once downloaded from the Internet, the programs are launched or included on a list of programs which will run automatically when the operating system boots up.
Information about the names and locations of the programs which are downloaded are in the Trojan code, or are downloaded by the Trojan from an Internet resource (usually a web page).
This type of malicious program is frequently used in the initial infection of visitors to websites which contain exploits.