Trojan-Downloader.Java.OpenConnection.cx

Technical Details
Payload
Removal instructions

Technical Details

This Trojan downloads files from the Internet and launches them without the user's knowledge. It is a Java class file. It is 7594 bytes in size.

Payload

The malware is a component of a Trojan downloader and includes a class file named "a", which downloads a file from the Internet, from a link sent to it. The file is saved in the current user's temporary files directory as

%Temp%\<rnd>.exe

where <rnd> is a random fractional decimal number from 0 to 1.

During its operation, the Trojan exploits a vulnerability in Java Runtime Environment (CVE-2010-0094). The vulnerability exists while deserializing RMIConnectionImpl objects; it enables the malicious user, outside of the virtualization environment, to call Java system functions by using ClassLoader. Java Runtime Environment (JRE) up to version 6, 18th update, is vulnerable. The Trojan constitutes a Java applet. It is launched from an infected HTML page using the "<APPLET>>" tag, for which an encrypted link to a downloadable file is sent in parameters named "trigger" and "a".

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Update JRE to the latest version.
2. Delete the following file:

   %Temp%\<rnd>.exe

3. Empty the Temporary Internet Files directory, which may contain infected files (see How to delete infected files from Temporary Internet Files folder?).

   %Temporary Internet Files%

4. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version). <\ol>

   MD5: 8B23051AD3C7433D01F6C3DA7C8655BC
   SHA1: 71C9DEAC29ADF51766E97EE9656146B7CAC5C762