Technical Details

A trojan program that uses the vulnerabilities in Oracle Java and Adobe Reader/Acrobat products to download and launch other malware. It is a HTML document containing Java Script. 88518 bytes.

Payload

The trojan uses Java Script to decipher its body and collect system information, in particular:

• Type of OS:

  Win
  Mac
  Linux
  FreeBSD
  iPhone
  iPod
  iPad
  Win.*CE
  Win.*Mobile
  Pocket *PC
  

• Installed browser:

  MS Internet Explorer
  Mozilla Firefox
  Safari
  Chrome
  Opera
  

• Plugins installed on the browser and ActiveX objects.
• MIME types supported by the browser.
• Versions of Java and AdobeReader installed.

The trojan then tries to exploit the vulnerabilities in Java, launching Java-applets located at the following links in the user's browser:

http://<domain_name_of the infected_server>/games/getJavaInfo.jar
http://<domain_name_of the infected_server>/games/mario.jar

name='prm'
value='<encrypted_link>'

tools.Commander.class

http://<domain_name_of the infected_server>/games/java_trust.php?f=32
http://<domain_name_of the infected_server>/games/java_skyline.php?f=32

Msxml2.XMLHTTP
Msxml2.DOMDocument
Microsoft.XMLDOM
ShockwaveFlash.ShockwaveFlash
TDCCtl.TDCCtl
Shell.UIHelper
Scripting.Dictionary
wmplayer.ocx

http://winresyn***nization.info/d.php?f=32&e=4

%Temporary Internet Files%\adobeupdate.exe

The link did not work when creating the description.

To implement Java applications in the browser, the trojan determines the following MIME types:

application/x-java-applet
application/x-java-vm
application/x-java-bean
application/x-java-applet
application/npruntime-scriptable-plugin;deploymenttoolkit
application/java-deployment-toolkit

\\216.***.203.202\pub\new.avi

http://winresyn***nization.info/d.php?f=32&e=2

{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}
{8AD9C840-044E-11D1-B3E9-00805F499D93}

{CA8A9780-280D-11CF-A24D-444553540000}

application/vnd.adobe.pdfxml
application/vnd.adobe.x-mars

http://<domain_name_of the infected_server>/games/2fdp.php?f=32
http://<domain_name_of the infected_server>/games/1fdp.php?f=32

The trojan then checks for the Windows Media Player extension and, if it finds it, it tries to open the following web resource in the hidden frame:

http://<domain_name_of the infected_server>/games/pch.php?f=32

Removal instructions

If your computer has not been protected with anti-virus software and has been infected with malware, you will need to take the following actions to delete this:

1. Delete the original trojan file (its location on the infected computer will depend on how the program got onto the computer).
2. Clear the Temporary Internet Files directory containing the infected files (How to delete infected files in the Temporary Internet Files folder?):

   %Temporary Internet Files%

3. Clear the temporary file directory:

   %Temp%\

4. Update JRE and JDK to the latest versions.
5. Install the latest version of Adobe Reader and Adobe Acrobat.
6. Disable the vulnerable ActiveX objects (How to stop launching the ActiveX control element in the Internet Explorer browser).
7. Run a full Kaspersky Antivirus scan of the computer with updated antivirus databases (download trial version).

MD5: 3E14DF63AF1C2F346F9BD58F83C745F6
SHA1: 813D45377A7C88573D0E1503B9861E5731C9756B

17 апреля 2024 года