TrojanDownloader:Java/Rexec.E

TrojanDownloader:Java/Rexec.E is a trojan Java applet that may download and execute arbitrary files.

Installation

TrojanDownloader:Java/Rexec.E may be loaded by a malicious website as a Java .JAR archive. The applet is called by an HTML page by referencing the "afp.class" stored in the .JAR file.

Payload

Downloads arbitrary files

TrojanDownloader:Java/Rexec.E attempts to download a binary file from a URL parameter or from a default URL.

It first attempts to get the URL parameter from the HTML code that loads it or from another Java class.

In the wild, TrojanDownloader:Java/Rexec.E has been observed to get a parameter with the following variable name from the HTML code or from the other Java class:

• nk

If no URL parameter is retrieved, it attempts to connect to the following URL to download and execute an arbitrary file:

• cristoteca<removed>21anos.com/web/ng.gif

As of this writing, the downloaded file from this URL is detected as VirTool:Win32/Delfinject.

The downloaded binary file is saved in the Java library folder with a random filename and then executed.

Analysis by Jonathan San Jose