Method of Infection
JS/Gumblar!generic is a malicious JavaScript which is embedded in compromised websites, when the user access these websites this malicious encoded JavaScript will redirects the user to a website where malicious JavaScript files are hosted.
These malicious JavaScript files will try to exploit different known browser exploits on the user browser. On successful exploitation they download a malware binary and execute it to compromise the user computer.
Back to top
Payload
When user visits any compromised website with embedded JS/Gumblar Trojan, it will redirect the user to a malicious websites to exploit the user browser. Majority of the JS/Gumblar variants will try to download a malicious PDF or ShockWave files to compromise the user computer.
In general JS/Gumblar variants will redirect to gumblar.cn and martuz.cn, but not limited to these domains. Web sites accessed by JS/Gumblar may vary.
CA antivirus solutions detect these Gumblar infections as JS/Gumblar generic.
Analysis by Satyendra Kumar Teppalavalasa
Back to top