live casino online

arrow_back
search
close

JS_COSMU.A

March 18, 2010
 Analysis by: adel
 PLATFORM:

Windows 2000, XP, Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW


This JavaScript has received attention from independent media sources and/or other security firms.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

This Trojan may be unknowingly downloaded by a user while visiting malicious websites. It may be hosted on a website and run when a user accesses the said website.

It takes advantage of software vulnerabilities to allow a remote user or malware/grayware to download files.

  TECHNICAL DETAILS

File Size:

Varies

File Type:

Script

Memory Resident:

No

Initial Samples Received Date:

17 Mar 2010

Payload:

Downloads files

Arrival Details

This Trojan may be unknowingly downloaded by a user while visiting malicious websites.

It may be unknowingly downloaded by a user while visiting the following malicious websites:

  • http://{BLOCKED}istyle.com/wap/include/wj/ie.html?332

It may be hosted on a website and run when a user accesses the said website.

Download Routine

This Trojan takes advantage of the following software vulnerabilities to allow a remote user or malware/grayware to download files:

After successfully exploiting the said vulnerability, this malware connects to the following URLs to possibly download other malicious files:

  • http://{BLOCKED}istyle.com/wap/include/2929.exe

It saves the files it downloads using the following names:

  • %User Profile%\Application Data\b.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

live casino online detects the dowloaded file as:

  • TROJ_DROPPR.FNZ

  SOLUTION

Minimum Scan Engine:

8.900

FIRST VSAPI PATTERN FILE:

6.935.00

FIRST VSAPI PATTERN DATE:

19 Mar 2010

VSAPI OPR PATTERN File:

7.521.00

VSAPI OPR PATTERN Date:

07 Oct 2010

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you to allow full scanning of your computer.

Step 2

Close all opened browser windows

Step 3

Remove malware files dropped/downloaded by JS_COSMU.A