Linkoptimizer Serial Killer
MAJOR SOLUTIONS. Reduce link size / Optimize resolution: LinkOptimizer will automatically reduce the image resolution, scale and crop the images in Photoshop according to their dimensions in the InDesign document and the target resolution specified, and reimport them to InDesign at 100%.
For the past few days, the AV team has been analyzing a set of files and URL’s that is related to a certain Linkoptimizer Trojan.
Earlier this day, Jovs posted about the site js.gbeb.cc which uses a unique way of obfuscating code. Now this particular site connects to other sites when accessed. The sites it connects to are the following:
Serial Killer Town Of Salem
- http://js.pcweb.cc
- http://xearl.com
- http://cvoesdjd.com
- http://lah3bum9.com
- http://gromozon.com
- http://td8eau9td.com
- http://mioctad.com
6-12 speakers. These sites in turn download TROJ_RKDICE.H with its rootkit component TROJ_LINKOPTIM.G.
TROJ_LINKOPTIM.G is a Browser Helper Object (BHO) that connects to these sites:
- http://www.flashkin.net/sl.php
- http://www.flashkin.net/common/template.php
- http://www.flashkin.net/sh.php
- http://www.flashkin.net/bs.php
- http://www.flashkin.net/wl.php
- http://www.flashkin.net/wlink.php
- http://www.flashkin.net/ws.php
- http://www.flashkin.net/gc.php
- http://washerner.com/
- http://chongchua.com/
- http://livingcert.com/
- http://fogcu.com/
For now, the sites mentioned above are blank (but our URL blocking now blocks these sites nevertheless).
Current Unsolved Serial Killers
Serial Killer Definition
The point of this blog entry is to emphasize that the infection cycle used by this trojan is an example of how malware use multiple components for propagation, obfuscation, and detection avoidance.