Trojan.HTML.PHISH.QURAAOOITE

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Diese Malware hat keine Verbreitungsroutine.

Diese Malware hat keine Backdoor-Routine.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Verbreitung

Diese Malware hat keine Verbreitungsroutine.

Backdoor-Routine

Diese Malware hat keine Backdoor-Routine.

Entwendete Daten

Sendet die gesammelten Daten über HTTP-POST an den folgenden URL:

• https://{BLOCKED}arconsulting.com/services/nancy.php

Andere Details

Es macht Folgendes:

• It disguises itself as a login page to access a document.
  
• It connects to the following URLs for images displayed inside the webpage:
• https://www.{BLOCKED}cture.com/q/blur_background.png
• On first login attempt, it will forcibly display a wrong password error.
• On the second login attempt, the webpage will be redirected to the domain of the inputted email:
• http://{domain}