Parent class: TrojWare
Trojans are malicious programs that perform actions which are not authorized by the user: they delete, block, modify or copy data, and they disrupt the performance of computers or computer networks. Unlike viruses and worms, the threats that fall into this category are unable to make copies of themselves or self-replicate. Trojans are classified according to the type of action they perform on an infected computer.Class: Trojan-Downloader
Programs classified as Trojan-Downloader download and install new versions of malicious programs, including Trojans and AdWare, on victim computers. Once downloaded from the Internet, the programs are launched or included on a list of programs which will run automatically when the operating system boots up. Information about the names and locations of the programs which are downloaded are in the Trojan code, or are downloaded by the Trojan from an Internet resource (usually a web page). This type of malicious program is frequently used in the initial infection of visitors to websites which contain exploits.Read more
Platform: Java
Java is a platform for developing and running programs written in the Java programming language.Description
The malware is a Java class file named "KAVS" and it is a component of a Trojan downloader from the "Trojan-Downloader.Java.OpenConnection" family. This class file is designed to exploit a vulnerability (CVE-2010-0840). JDK and JRE up to version 6, 18th update, are vulnerable. The vulnerability appears due to improper verification when executing privileged methods in Java Runtime Environment; this enables the malicious user to execute a random code with a specially modified object, which is a subclass file of the trusted class file. In this case the "KAVS" class file inherits the "getValue()" method of the "Expression" class file. Such inheritance cannot be executed directly from the malicious class file, which is a subclass file of non-privileged "Applet" class file. This way the Trojan is able to use the "getValue()" method to execute its malicious activity.
Read more
Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com