JAVA_HOXO.NM

This Trojan may be downloaded by other malware/grayware/spyware from remote sites. It may be unknowingly downloaded by a user while visiting malicious websites.

It takes advantage of software vulnerabilities to allow a remote user or malware/grayware to download files. It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

It checks the operating system name of the affected computer.

Arrival Details

This Trojan may be downloaded by other malware/grayware/spyware from remote sites.

It may be unknowingly downloaded by a user while visiting malicious websites.

This malware arrives via the following means:

• It is a component of a malicious Java archive file (.JAR) that is hosted in a malicious Web site.

Download Routine

This Trojan takes advantage of the following software vulnerabilities to allow a remote user or malware/grayware to download files:

• CVE-2009-3867

It saves the files it downloads using the following names:

• %User Temp%\h.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Other Details

This Trojan checks the operating system name of the affected computer if it is any of the following:

• Windows platform