JAVA_BANLOAD.UASA

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

It connects to certain websites to send and receive information.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %Application Data%\Sun\Java\Deployment\{random string}\{random string}.mp3 (decompressed copy of pp64.pdf or pp32.pdf)
• %Application Data%\Sun\Java\Deployment\{random string}\{random string}.xml (decompressed copy of ss64.pdf or ss32.pdf)
• %Application Data%\Sun\Java\Deployment\{random string}\{random string}.wmv (decompressed copy of jjgf.pdf)
• %Application Data%\Sun\Java\Deployment\{random string}\{random string}.bat - executes ".xml" file
• %User StartUp%\{random}.LNK - point to real{random numbers}.vbs
• %User Temp%\real{random numbers}.vbs - execute downloaded files
• %User Temp%\tmp{random numbers}.vbs - get drive serial number

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It creates the following folders:

• %Application Data%\Sun\Java\Deployment\{random string}

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Download Routine

This Trojan connects to the following URL(s) to download its component file(s):

• http://{BLOCKED}.{BLOCKED}.167.26/pdf/pp64.pdf (64-bit)
• http://{BLOCKED}.{BLOCKED}.167.26/pdf/ss64.pdf (64-bit)
• http://{BLOCKED}.{BLOCKED}.167.26/pdf/pp32.pdf (32-bit)
• http://{BLOCKED}.{BLOCKED}.167.26/pdf/ss32.pdf (32-bit)
• http://{BLOCKED}.{BLOCKED}.167.26/pdf/jjgf.pdf

It saves the files it downloads using the following names:

• %Application Data%\{random string}\pp64.pdf (64-bit)
• %Application Data%\{random string}\ss64.pdf (64-bit)
• %Application Data%\{random string}\pp32.pdf (32-bit)
• %Application Data%\{random string}\ss32.pdf (32-bit)
• %Application Data%\{random string}\jjgf.pdf

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Information Theft

This Trojan gathers the following data:

• Hostname
• Drive Serial Number
• OS Name
• GbPlugin Path

Other Details

This Trojan connects to the following website to send and receive information:

• http://{BLOCKED}.{BLOCKED}.167.26/pdf/50A0.php?90F80E63A5E911={Hostname}&00097DF2070609={OS Name}&F218798382F902={GBplugin Path}&C5C63157A8D83F=={Drive Serial Number}

It does the following:

• It checks if the affected machine is in the following countries:
  • Brasil
  • Portugal
• It checks if the following file exist:
  • %Application Data%\Sun\Java\Deployment\Sun.jar
• It executes the following command to restart the affected machine:
  • shutdown -r -t 30 -c Atualizando...

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)