Exploit:Java/CVE-2010-0840.HH

Exploit:Java/CVE-2010-0840.HH is the detection for a malicious and obfuscated Java class that exploits a vulnerability described in CVE-2010-0840. Successful exploitation may lead to the downloading and execution of arbitrary files under the user's security context.

Installation

Exploit:Java/CVE-2010-0840.HH is one component of a  Java applet Trojan which may be distributed within a Java package with a name similar to “package rotor”.   
 
In the wild, we have observed this malicious Java class applet being bundled with the following Java classes and present on affected computers under the folder \rotor\:

• zalux.class - detected as Exploit:Java/CVE-2010-0840.HH
• zalux$1.class - detected as Exploit:Java/CVE-2010-0840.DR
• zalux$vrkr.class - detected as Exploit:Java/CVE-2010-0840.HH
• Glocker.class - detected as TrojanDownloader:Java/OpenConnection.OU
• Zo666.class – detected as TrojanDownloader:Java/OpenConnection.OU
• Zom.class - detected as TrojanDownloader:Java/OpenConnection.OU
• Zom2.class

When a user visits a website that contains the applet using a computer that has a vulnerable version of Sun Java, security checks may be bypassed, allowing arbitrary code to be executed. 

Payload

Downloads and executes arbitrary files

When the exploitation is successful, Exploit:Java/CVE-2010-0840.HH attempts to download and execute a malicious program from a specified URL.  In the wild we have seen the following URLs being used in this manner:
www.duramig.com/<removed>/bluefind.gif
www.duramig.com/<removed>/aglomb.png

It then saves the downloaded file to %TEMP%\<random number>.exe and runs the file. The selected of the file that is downloaded and executed is arbitrary and could include additional malware of the attacker's choice.

Analysis by Wei Li