Trojan-Downloader.Java.OpenConnection

The malware is a Java class file named “KAVS” and it is a component of a Trojan downloader from the “Trojan-Downloader.Java.OpenConnection” family. This class file is designed to exploit a vulnerability (CVE-2010-0840). JDK and JRE up to version 6, 18th update, are vulnerable.

The vulnerability appears due to improper verification when executing privileged methods in Java Runtime Environment; this enables the malicious user to execute a random code with a specially modified object, which is a subclass file of the trusted class file. In this case the “KAVS” class file inherits the “getValue()” method of the “Expression” class file. Such inheritance cannot be executed directly from the malicious class file, which is a subclass file of non-privileged “Applet” class file. This way the Trojan is able to use the “getValue()” method to execute its malicious activity.