JAVA_TARUL.A
ALIASES:
Troj/JavaJar-E(Sophos); Java/Agent.R(ESET); Trojan.Java.Agent.dt(Kaspersky)
PLATFORM:
Windows
OVERALL RISK RATING:
DAMAGE POTENTIAL:
DISTRIBUTION POTENTIAL:
REPORTED INFECTION:
INFORMATION EXPOSURE:
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
TECHNICAL DETAILS
File Size:
39,923 bytes
File Type:
JAR
Memory Resident:
No
Initial Samples Received Date:
02 Jun 2015
Arrival Details
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Download Routine
This Trojan saves the files it downloads using the following names:
- %Temp%\{random numbers}.jar
(Note: %Temp% is the Windows temporary folder, where it usually is C:\Windows\Temp on all Windows operating system versions.)
Other Details
This Trojan connects to the following possibly malicious URL:
- http://{BLOCKED}.{BLOCKED}.3.250/downloads/QRat-agent.jar
- http://www.{BLOCKED}se.com/downloads/QRat-agent.jar
- http://{BLOCKED}se.com/downloads/QRat-agent.jar