Trojan-Downloader.Java.OpenConnection.cg

Technical Details

This malware is a component of a Trojan, which downloads files from the Internet without the user's knowledge. It is a Java class file. It is 672 bytes in size.

Payload

The malware is a Java class file named "KAVS" and it is a component of a Trojan downloader from the "Trojan-Downloader.Java.OpenConnection" family. This class file is designed to exploit a vulnerability (CVE-2010-0840). JDK and JRE up to version 6, 18th update, are vulnerable. The vulnerability appears due to improper verification when executing privileged methods in Java Runtime Environment; this enables the malicious user to execute a random code with a specially modified object, which is a subclass file of the trusted class file. In this case the "KAVS" class file inherits the "getValue()" method of the "Expression" class file. Such inheritance cannot be executed directly from the malicious class file, which is a subclass file of non-privileged "Applet" class file. This way the Trojan is able to use the "getValue()" method to execute its malicious activity.

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Update JDK and JRE to the latest versions.
2. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).

MD5: 80BFEAAD82B1CEE10DD9965E32B183C5
SHA1: C9FC5D3940B9750663B127E2290E433120860BA6