Infection Channel: Downloaded from the Internet
This malware is related to Neutrino, an exploit kit sold in underground cybercrime.
This Trojan may arrive bundled with malware packages as a malware component. It may be hosted on a website and run when a user accesses the said website.
It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.
File size: Varies
File type: Java Class
Initial samples received date: 07 Mar 2013
Payload: Downloads files
Arrival Details
This Trojan may arrive bundled with malware packages as a malware component.
It may be hosted on a website and run when a user accesses the said website.
Download Routine
This Trojan takes advantage of the following software vulnerabilities to download possibly malicious files:
It saves the files it downloads using the following names:
- %User Temp%\~tmp{Random Numbers}.exe
(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)
Trend Micro detects the dowloaded file as:
It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.
It downloads a possibly malicious file from a certain URL. The URL where this malware downloads the said file depends on the following parameter(s) passed on to it by its components:
Connect with us on
| | | |