JAVA_STREAM.AJ

It takes advantage of the Unspecified vulnerability in the Java Runtime Environment component to download possibly malicious files.

It usually arrives as a malware component inside a malicious .JAR file. This malicious Java class accesses the "game_id" parameter in a certain HTML file that executes this file to get the URL where a binary can be downloaded.

This Trojan may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.

Arrival Details

This Trojan may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

Download Routine

This Trojan takes advantage of the following software vulnerabilities to download possibly malicious files:

• Unspecified vulnerability in the Java Runtime Environment component

It saves the files it downloads using the following names:

• %User Temp%\{random}.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

Other Details

This Trojan does the following:

• It usually arrives as a malware component inside a malicious .JAR file. This malicious Java class accesses the "game_id" parameter in a certain HTML file that executes this file to get the URL where a binary can be downloaded.