Attention: We have transitioned to a new AAD or Microsoft Entra ID from the week of May 20, 2024. In case your tenant requires admin consent, please refer to this document located at Overview of user and admin consent - Microsoft Entra ID | Microsoft Learn and grant access to App ID: 6ba09155-cb24-475b-b24f-b4e28fc74365 with graph permissions for Directory.Read.All and User.Read for continued access. While the app may appear unverified, you can confirm its legitimacy by verifying the App ID provided.
TrojanDownloader:Java/OpenConnection.OU is an obfuscated Java class applet trojan that attempts to download and execute arbitrary files from remote servers.
To detect and remove this threat and other malicious software that may be installed on your computer, run a full-system scan with an appropriate, up-to-date, security solution. The following Microsoft products detect and remove this threat:
This threat may exploit a known vulnerability in the Java Runtime Environment (JRE). To prevent your computer from being vulnerable to this malware, make sure that you install the updates available from the vendor. You can read more about this vulnerability from the following links:
TrojanDownloader:Java/OpenConnection.OU is an obfuscated Java class applet trojan that attempts to download and execute arbitrary files from remote servers.
Installation
TrojanDownloader:Java/OpenConnection.OU is usually bundled with other malware that exploits the vulnerability described in CVE-2010-0840. When successful exploitation occurs, the trojan will download and execute files from remote servers.
The vulnerability can be exploited by the trojan to gain access to a user's computer to download and install malicious programs. Installation may occur when a malicious Java applet is executed by a vulnerable JRE (Java Runtime Environment). This can occur when a user visits a malicious webpage that hosts such an applet. Note that a number of legitimate websites could be compromised or unwillingly host a malicious applet through advertising frames which could redirect to or host a malicious Java applet.
Payload
Downloads and executes arbitrary files
If the exploitation is successful, TrojanDownloader:Java/OpenConnection.OU attempts to download and execute a malicious program from a specified URL, for example, varbosta.com.