JS/Kryptik.AMT!tr

Analysis

JS/Kryptik.AMT!tr is a generic detection for a type of obfuscated JavaScript trojan that uses a certain function to decode itself. When the decoded codes are executed, it redirects the web browser to other sites that may contain malicious content.
Most samples usually open a new browser window using the window.open()  JavaScript function. However, there are instances of this malware that contain a link to directly download an executable file.

• Examples of web sites that this malware redirects to are the following:
  
  • ftp://ftp.gba{Removed}.com
  • http://download.lk7{Removed}.com

Recommended Action

FortiGate Systems

• Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.
  FortiClient Systems
  
• Quarantine/delete files that are detected and replace infected files with clean backup copies.