live casino online

arrow_back
search
close

JS_FIEROPS.A

October 09, 2012
 Analysis by: Jasen Sumalapao
 ALIASES:

Trojan-Downloader.JS.Agent.gtt, Trojan-Downloader.JS.Agent.gtt (Kaspersky), Trojan-Downloader.JS.Agent (Ikarus)

 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: Yes

  • In the wild: Yes

  OVERVIEW

Infection Channel:

Downloaded from the Internet


This Trojan may arrive bundled with malware packages as a malware component. It may be hosted on a website and run when a user accesses the said website.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

  TECHNICAL DETAILS

File Size:

5,413 bytes

File Type:

HTML, HTM, JS

Initial Samples Received Date:

27 Aug 2012

Payload:

Downloads files

Arrival Details

This Trojan may arrive bundled with malware packages as a malware component.

It may be hosted on a website and run when a user accesses the said website.

It may be downloaded from the following remote sites:

  • http://ok.{BLOCKED}4.net/meeting/index.html
  • http://{BLOCKED}.{BLOCKED}.104.149/public/meeting/index.html

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

  • http://{BLOCKED}.{BLOCKED}.104.149/public/meeting/applet.jar - detected as JAVA_GONDY.A
  • http://{BLOCKED}.{BLOCKED}.104.149/public/meeting/Flash_update.exe - detected as BKDR_POISON.BLW

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

  SOLUTION

Minimum Scan Engine:

9.200

FIRST VSAPI PATTERN FILE:

9.352.01

FIRST VSAPI PATTERN DATE:

27 Aug 2012

VSAPI OPR PATTERN File:

9.353.00

VSAPI OPR PATTERN Date:

28 Aug 2012

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you to allow full scanning of your computer.

Step 2

Remove malware/grayware files dropped/downloaded by JS_FIEROPS.A