Trojan.HTML.PHISH.FO

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Diese Malware hat keine Verbreitungsroutine.

Diese Malware hat keine Backdoor-Routine.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Verbreitung

Diese Malware hat keine Verbreitungsroutine.

Backdoor-Routine

Diese Malware hat keine Backdoor-Routine.

Datendiebstahl

Folgende Daten werden gesammelt:

• Specific Email
• Input Password

Entwendete Daten

Sendet die gesammelten Daten über HTTP-POST an den folgenden URL:

• http://22.{BLOCKED}ss.com//wp-includes/IXR/ORDER/awoko.php

Andere Details

Es macht Folgendes:

• It disguises itself as a login page to access a document:
  
  • Clicking the 'Open' button reveals the login form to input the user credentials.
• It connects to the following URLs to display images inside the webpage:
  • https://i.{BLOCKED}/934cee31d5268a86c613c5ac8999f886.png
  • https://{BLOCKED}.net/wp-content/uploads/2022/02/Microsoft-Excel-Symbol.png
  • https://{BLOCKED}.com/I6kN-6X7nhAAAAAj/loading-buffering.gif
• After sending the user credentials, the webpage will be redirected to the following URL:
  • https://{BLOCKED}.com/864663fe4e09146419bb8a9509b320e1.png