Trojan.Maljava!gen24

Posted: September 3, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	9/10
Infected PCs:	94

First Seen:	September 3, 2012
OS(es) Affected:	Windows

Trojan.Maljava!gen24 is a behavior-based alert for attacks associated with certain types of malicious Java Runtime Environment content, including some zero-day exploits that have not yet been issued a patch by the Oracle company. Trojan.Maljava!gen24 attacks are currently closely-associated with payloads that include backdoor Trojans such as Trojan.Taidoor, although Trojan.Taidoor has also been found to use alternate methods to infect new PCs. Contact with Trojan.Maljava!gen24 can be precipitated by links in e-mail spam, browser redirects or any other means of exposure to websites that can host Java-based code, and Trojan.Maljava!gen24's attacks don't display symptoms beyond any alerts that your anti-malware programs may cause. SpywareRemove.com malware experts recommend that you keep such software available and active, since Trojan.Maljava!gen24's inclusion of some zero-day exploits can mean that even having the most updated Java possible will not protect your PC from an infection.

Trojan.Maljava!gen24 is associated with other Java-based PC threats such as Java.Awetook and Trojan.Maljava, and, as such, Trojan.Maljava!gen24 may only be one of several steps used to compromise your computer. Because contact with Trojan.Maljava!gen24 is based on your web browser, keeping Java disabled as a default security option will prevent Trojan.Maljava!gen24 and similar Java-based attacks from being launched (although these methods will not protect against all types of drive-by-download attacks). While Java is active, all prominent browsers are vulnerable to Trojan.Maljava!gen24, along with most versions of Windows and Linux.

The latest vulnerability that Trojan.Maljava!gen24 exploits, CVE-2012-4681, has been available 'in the wild' for some time. Initially, this was considered a zero-day exploit: an exploit without a corresponding security patch that fixes it. However, since that time, Oracle has issued a patch for this particular exploit by Trojan.Maljava!gen24. Nonetheless, SpywareRemove.com malware research team notes that the incident remains significant in that it's the first visible sign of Trojan.Taidoor being installed through zero-day exploits instead of exploits that could be prevented by patching your software. Assuming a lack of proper anti-malware and browser security, victims who visit a site with Trojan.Maljava!gen24 will become infected by Trojan.Taidoor or another PC threat automatically.

Trojan.Maljava!gen24 - Why What You Can't See Can Still Hurt You

Neither Trojan.Maljava!gen24 nor its payload, Trojan.Taidoor, show symptoms of their attacks – and Trojan.Taidoor additionally is disguised as a fake Java update file, according to its file name. However, SpywareRemove.com malware experts warn that a successful Trojan.Maljava!gen24 attack can result in severely-compromised security by the following means:

The presence of a backdoor vulnerability that could be used to control or access your PC from a C&C server.
The possibility of confidential information stolen from your PC by Trojan.Taidoor recording this information to a log file and uploading this file to its server (typically at pre-specified times).
The potential for many other types of PC threats to be installed on your computer by Trojan.Taidoor such as keyloggers, browser hijackers or banking Trojans.

While Trojan.Maljava!gen24 is a web page-based threat that doesn't need to be removed from your hard drive, the Trojan.Taidoor infection that's caused by Trojan.Maljava!gen24 should be deleted by a trustworthy anti-malware product.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

XepadVQ1.jpg

File name: XepadVQ1.jpg
Size: 4.12 KB (4123 bytes)
MD5: ad070f6f3e7b2e1047097d205187bcd5
Detection count: 94
Mime Type: unknown/jpg
Group: Malware file
Last Updated: February 19, 2013

install.jar

File name: install.jar
Size: 39.18 KB (39181 bytes)
MD5: 44a67e980f49e9e2bed97ece130f8592
Detection count: 93
Mime Type: unknown/jar
Group: Malware file
Last Updated: February 19, 2013

YmLA3.zip

File name: YmLA3.zip
Size: 4.11 KB (4118 bytes)
MD5: 2f753a2191bc1d4704de784f60b8c7ad
Detection count: 87
Mime Type: unknown/zip
Group: Malware file
Last Updated: February 19, 2013

Trojan.Maljava!gen24

Threat Metric

Trojan.Maljava!gen24 - Why What You Can't See Can Still Hurt You

Technical Details

File System Modifications

Leave a Reply