Trojan.HTML.PHISH.VSNTJK22

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Information Theft

This Trojan gathers the following data:

• Specific Email
• Input Password

Stolen Information

This Trojan sends the gathered information via HTTP POST to the following URL:

• https://{BLOCKED}-form.com/9TC5TMBo

Other Details

This Trojan does the following:

• It disguises itself as a login page to access a document
  
• It connects to the following URLs for images displayed inside the webpage:
  • https://{BLOCKED}7.{BLOCKED}g.com/pngimages/571/47/png-clipart-adobe-acrobat-pdf-computer-icons-adobe-reader-edu-invest-adobe-pdf-text-logo-thumbnail.png
• After sending the user credentials, the webpage will be redirected to the following URL (tracked as non-malicious):
  • https://www.outlook.com/mail/0?email={BLOCKED}