Avast community forum
Home
Help
Search
Login
Register
Avast WEBforum
»
Other
»
Viruses and worms
(Moderators:
Maxx_original
,
misak
) »
What exactly do JS:Cryxos-O [Trj]?
« previous
next »
Print
Pages: [
1
]
Go Down
Author
Topic: What exactly do JS:Cryxos-O [Trj]? (Read 2011 times)
0 Members and 1 Guest are viewing this topic.
TheOwner
Poster
Posts: 409
What exactly do JS:Cryxos-O [Trj]?
«
on:
August 18, 2023, 12:34:40 AM »
Hi, what exactly this malware do?
h
XX
ps://zpb.bvdssej.tk/21006749.js [L] JS:Cryxos-O [Trj] (0)
Avast blocked it, so my PC is not infected?
Thank you.
«
Last Edit: August 18, 2023, 12:46:46 AM by TheOwner
»
Logged
DavidR
Avast Überevangelist
Certainly Bot
Posts: 89287
No support PMs thanks
Re: What exactly do JS:Cryxos-O [Trj]?
«
Reply #1 on:
August 18, 2023, 12:54:52 AM »
Correct, the Web Shield (presumably) is the shield that made the detection so it effectively blocks any download or running of the .js file
Logged
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.5.6116 (build 24.5.9153.762) UI 1.0.808/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security
DavidR
Avast Überevangelist
Certainly Bot
Posts: 89287
No support PMs thanks
Re: What exactly do JS:Cryxos-O [Trj]?
«
Reply #2 on:
August 18, 2023, 01:09:14 AM »
Update - One hit on virustotal on the domain -
https://www.virustotal.com/gui/url/63f6c1dd2c998318e7dafe995b0fd37b794071ac12398dab0a46b73a67e2d95e/detection
Some security related pointers on that site -
https://en.internet.nl/site/zpb.bvdssej.tk/2275494/
Medium Security Risk reported here -
https://sitecheck.sucuri.net/results/zpb.bvdssej.tk
- with some hardening improvements mentioned.
Considered a Medium Security Risk here -
https://quttera.com/detailed_report/zpb.bvdssej.tk
The DrWeb file scanner doesn't find anything (no guarantees though), see attached image.
Logged
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.5.6116 (build 24.5.9153.762) UI 1.0.808/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security
TheOwner
Poster
Posts: 409
Re: What exactly do JS:Cryxos-O [Trj]?
«
Reply #3 on:
August 18, 2023, 01:15:54 AM »
Thank you for answer. So it looks it is not that dangerous.
Logged
DavidR
Avast Überevangelist
Certainly Bot
Posts: 89287
No support PMs thanks
Re: What exactly do JS:Cryxos-O [Trj]?
«
Reply #4 on:
August 18, 2023, 02:25:52 AM »
You're welcome.
A possibility of a false positive, but backed up by the Web Shield if it weren't an FP.
Logged
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.5.6116 (build 24.5.9153.762) UI 1.0.808/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security
Pondus
Probably Bot
Posts: 37601
Not a avast user
Re: What exactly do JS:Cryxos-O [Trj]?
«
Reply #5 on:
August 19, 2023, 10:55:47 AM »
Quote
Hi, what exactly this malware do?
F-secure info:
Cryxos trojans display an alarming notification message saying that the user's computer or web browser has been 'blocked' due to a virus infection, and that their personal details are 'being stolen'. The user is then directed to call a phone number for assistance in the 'removal process'. This is a version of a 'call support' scam.
Logged
polonus
Avast Überevangelist
Probably Bot
Posts: 33926
malware fighter
Re: What exactly do JS:Cryxos-O [Trj]?
«
Reply #6 on:
August 19, 2023, 12:04:34 PM »
ASN data for IP 104.21.34.80 show that this abuse was performed via a Cloudflare hosted domain.
Re:
https://sitereport.netcraft.com/?url=http://zpb.bvdssej.tk
Netcraft risk:10 out of 10.
More malicious domains are being hosted via Cloudflare. Take nothing for granted to-day.
And do not click links from mails that are/seem suspicious.
polonus
Logged
Cybersecurity is more of an attitude than anything else. Avast Evangelists.
Use NoScript, a limited user account and a virtual machine and be safe(r)!
Print
Pages: [
1
]
Go Up
« previous
next »
Avast WEBforum
»
Other
»
Viruses and worms
(Moderators:
Maxx_original
,
misak
) »
What exactly do JS:Cryxos-O [Trj]?