JAVA_JNANA.A

Arrival Details

This Trojan may be downloaded from the following remote sites:

• http://{BLOCKED}e.comuv.com/jnana.tsa

Installation

This Trojan creates the following folders:

• %User Profile%\jnana

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Other Details

This Trojan does the following:

• It generates URLs by concatenating strings as http://{random string}.{domain} and downloading the file applet_hosts.txt from the generated URL.
  

  {domain} may be any of the following:

  • {BLOCKED}o.info
  • {BLOCKED}ons.com
  • {BLOCKED}vino.cl
  • {BLOCKED}ine.com
  • {BLOCKED}ink.com
  • {BLOCKED}e.org.ru
  • {BLOCKED}_hosts.txt
  • {BLOCKED}reshproduce.com
  • {BLOCKED}v.ch
  • {BLOCKED}x.info
  • {BLOCKED}c59.com
  • {BLOCKED}me.net
  • {BLOCKED}ec.ch
  • {BLOCKED}uctions.com.ru
  • {BLOCKED}anca.net.ru
  • {BLOCKED}nkiller.com
  • {BLOCKED}ersforpeace.net
  • {BLOCKED}usician.com.ru
  • {BLOCKED}neshockey.com
  • {BLOCKED}mafia.info
  • {BLOCKED}l-forever.com
  • {BLOCKED}aler24.info
  • {BLOCKED}eddesigners.com
  • {BLOCKED}tuff.com.ru
  • {BLOCKED}d.info
  • {BLOCKED}a.biz
  • {BLOCKED}d.one.pl
  • {BLOCKED}k.la
  • {BLOCKED}habal.org
  • {BLOCKED}alc.com.ru
  • {BLOCKED}etorrents.net
  • {BLOCKED}retorrents.org
  • {BLOCKED}e.kg
  • {BLOCKED}rmfoods.com.ru
  • {BLOCKED}o.org
  • {BLOCKED}o.tm
  • {BLOCKED}atix.com.ru
  • {BLOCKED}f.com
  • {BLOCKED}so.com
  • {BLOCKED}r.la
  • {BLOCKED}u.biz
  • {BLOCKED}usicsearch.com
  • {BLOCKED}n.org.ru
  • {BLOCKED}nbath.com
  • {BLOCKED}t.us
  • {BLOCKED}upongoogle.com
  • {BLOCKED}osetrains.com
  • {BLOCKED}h.org
  • {BLOCKED}ker.biz
  • {BLOCKED}ag.info
  • {BLOCKED}asplace.com.ru
  • {BLOCKED}s.info
  • {BLOCKED}n.org.ru
  • {BLOCKED}ne.net
  • {BLOCKED}ne.org
  • {BLOCKED}o.info
  • {BLOCKED}p.biz
  • {BLOCKED}p.org
  • {BLOCKED}c.com
  • {BLOCKED}n.net
  • {BLOCKED}sexpress.info
  • {BLOCKED}t.com
  • {BLOCKED}t.org
  • {BLOCKED}p.biz
  • {BLOCKED}p.org
  • {BLOCKED}h.com
  • {BLOCKED}e.org.ru
  • {BLOCKED}alecstasy.com
  • {BLOCKED}alxtasy.com
  • {BLOCKED}olomon.net
  • {BLOCKED}sdiller.com
  • {BLOCKED}frame.com
  • {BLOCKED}sdiller.us
  • {BLOCKED}t.ch
  • {BLOCKED}p.com
  • {BLOCKED}sionalcopy.net
  • {BLOCKED}c.to
  • {BLOCKED}t.la
  • {BLOCKED}o24.ch
  • {BLOCKED}gwranchinc.com
  • {BLOCKED}ell.la
  • {BLOCKED}e.com
  • {BLOCKED}drive.com
  • {BLOCKED}i.org
  • {BLOCKED}are.com
  • {BLOCKED}eer.com
  • {BLOCKED}log.net
  • {BLOCKED}tp.com
  • {BLOCKED}ame.com
  • {BLOCKED}alflife.com
  • {BLOCKED}ttp.com
  • {BLOCKED}rc.com
  • {BLOCKED}p3.com
  • {BLOCKED}nguins.com
  • {BLOCKED}l.la
  • {BLOCKED}t.la
  • {BLOCKED}p.tm
  • {BLOCKED}oolboys.com
  • {BLOCKED}og.com
  • {BLOCKED}t.ch
  • {BLOCKED}echnology.net
  • {BLOCKED}ostma.com
  • {BLOCKED}thx.net
  • {BLOCKED}ome.net
  • {BLOCKED}meofadown.com
  • {BLOCKED}8.net
  • {BLOCKED}ideas.com
  • {BLOCKED}g.la
  • {BLOCKED}ndo.one.pl
  • {BLOCKED}ls.com
  • {BLOCKED}ia.info
  • {BLOCKED}t.info
  • {BLOCKED}i.net
  • {BLOCKED}i.org
  • {BLOCKED}tiburon.org
  • {BLOCKED}htparadox.com
  • {BLOCKED}k.to
  • {BLOCKED}icks.com
  • {BLOCKED}s.to
  • {BLOCKED}ies.com
  • {BLOCKED}d.net
  • {BLOCKED}erfect.net
  • {BLOCKED}irkforce.de
  • {BLOCKED}om.bz
  • {BLOCKED}2.bz
  • {BLOCKED}t.net
  • {BLOCKED}e.info
  • {BLOCKED}hostingcompany.net
  • {BLOCKED}oo.info
  • {BLOCKED}n.com
  • {BLOCKED}dings.com

  However, the domains are already inaccessible and redirects to nonmalicious search portals when accessed.

• It uses JAVAW.EXE to run .JAR files.