JS_WEBSTART.A

April 16, 2010
 Analysis by: JocelynR
 PLATFORM:

Windows 98, ME, NT, 2000, XP, Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

Trend Micro has flagged this JavaScript as noteworthy due to the increased potential for damage, propagation, or both, that it possesses. Specifically, it exploits the recently discovered Java Vulnerability to allow an attacker to run commands on the affected system.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

  TECHNICAL DETAILS

File Size:

5,294 bytes

Memory Resident:

Yes

Initial Samples Received Date:

15 Apr 2010

Arrival Details

This Trojan may be downloaded from the following remote site(s):

  • http://www.{BLOCKED}ancomcareers.com/vasek

Other Details

Based on analysis of the codes, it has the following capabilities:

  • Exploits the Java Web Start Vulnerability that allow attackers to run commands via a Java Archive (.JAR) file on the user's system without the need for a user name and password
  • Connects to the URL http://www.{BLOCKED}ancomcareers.com/vasek/files/gsb50.jar to execute the hosted malicious Java Applet detected as JAVA_WEBSTART.A

More information on this vulnerability can be found below:

  • http://www.oracle.com/technology/deploy/security/alerts/alert-cve-2010-0886.html

  SOLUTION

Minimum Scan Engine:

8.900

FIRST VSAPI PATTERN FILE:

7.105.00

FIRST VSAPI PATTERN DATE:

17 Apr 2010

VSAPI OPR PATTERN File:

7.105.00

VSAPI OPR PATTERN Date:

17 Apr 2010

Step 1

Close all opened browser windows

Step 2

Remove malware files dropped/downloaded by JS_WEBSTART.A

Step 3

Scan your computer with your Trend Micro product to delete files detected as


*Note: If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Step 4

Download and apply this security patch Refrain from using these products until the appropriate patches have been installed. Trend Micro advises users to download critical patches upon release by vendors.


Did this description help? Tell us how we did.

Related Malware