JAVA_EXPLOYT.MBC

October 09, 2012
 Analysis by: Michael Cabel
 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  TECHNICAL DETAILS

File Size:

4,986 bytes

File Type:

Java Class

Initial Samples Received Date:

30 Jun 2011

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

NOTES:

This Trojan downloads a possibly malicious file from a certain URL. The URL where this malware downloads the said file depends on the parameter passed onto it by its components.

It determines the type of the downloaded file, whether .EXE or .DLL, and saved these as follows:

  • %User Temp%\{Random number}.exe
  • %User Temp%\{Random number}.dll

It then executes the downloaded file.