Trojan:JS/Redirector.JL

Installation

Trojan:JS/Redirector.JL may be detected on your computer if you visit a malicious or compromised webpage.

The trojan is a JavaScript that may be injected into malicious or compromised webpages via SQL injection.

Payload

If you visit a webpage that contains Trojan:JS/Redirector.JL, your browser may be redirected to a malicious website. Your browser may continue to be redirected multiple times.

These malicious websites may contain other malware, including rogues and exploits.

In the wild, we have observed this trojan redirecting web browsers to a number of URLs, including the following:

• fgthyj.com/<removed>.php
• hgbyju.com/<removed>.php
• hnjhkm.com/<removed>.php
• nikjju.com/<removed>.php
• nmmkmm.com/<removed>.php
• statsmy.com/<removed>.php
• stmyst.com/<removed>.php

Note that this list is not exhaustive.

Analysis by Karthik Selvaraj