JS/Kryptik.AOG!tr

Analysis

JS/Kryptik.AOG!tr is a generic detection for a type of obfuscated JavaScript trojan that uses a certain function to decode itself. When the decoded codes are executed, it redirects the web browser to other sites that may contain malicious content.

• Examples of web sites that this malware redirects to are the following:
  
  • http://infin{Removed}.com/images/cnGbDtCm.php
  • http://www.rhon{Removed}.org/7KXJ6khc.php
  • http://8164e5d74f4e0855.lo{Removed}.jp/js/4cCvQzdy.php
  • http://trin{Removed}.com/vwDhY73V.php

Recommended Action

FortiGate Systems

• Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.
  FortiClient Systems
  
• Quarantine/delete files that are detected and replace infected files with clean backup copies.