Trojan.HTML.PHISH.GS

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Diese Malware hat keine Verbreitungsroutine.

Diese Malware hat keine Backdoor-Routine.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Verbreitung

Diese Malware hat keine Verbreitungsroutine.

Backdoor-Routine

Diese Malware hat keine Backdoor-Routine.

Datendiebstahl

Folgende Daten werden gesammelt:

• Specific Email
• Input Password

Entwendete Daten

Sendet die gesammelten Daten über HTTP-POST an den folgenden URL:

• https://www.{BLOCKED}iew.com/wp-content/themes/twentythirteen/Bill/file1.php

Andere Details

Es macht Folgendes:

• It displays a pop-up message indicating a login required before proceeding:
  
• It disguises itself as a login page to lure the user into submitting the login credentials to a malicious link:
  
• It redirects the browser to the following webpage after submitting the credentials:
  • https://{BLOCKED}ic.com/sites/default/files/inline-images/Invoice%203.jpg
• It connects to the following URLs for images displayed inside the webpage:
  • https://{BLOCKED}ic.com/sites/default/files/inline-images/Invoice%203.jpg
  • https://{BLOCKED}ad.logo.wine/logo/Microsoft_Excel/Microsoft_Excel-Logo.wine.png
  • https://u{BLOCKED}ikimedia.org/wikipedia/commons/thumb/7/73/Microsoft_Excel_2013-2019_logo.svg/2086px-Microsoft_Excel_2013-2019_logo.svg.png