Trojan.HTML.PHISH.JA

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Diese Malware hat keine Verbreitungsroutine.

Diese Malware hat keine Backdoor-Routine.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Verbreitung

Diese Malware hat keine Verbreitungsroutine.

Backdoor-Routine

Diese Malware hat keine Backdoor-Routine.

Datendiebstahl

Folgende Daten werden gesammelt:

• Specific Email
• Input Password
• Public IP Address

Entwendete Daten

Sendet die gesammelten Daten über HTTP-POST an den folgenden URL:

• https://{BLOCKED}gram.org/bot78990817{BLOCKED}Gt_J9-Fp0cGhcv7z_gUH1fhcbbrd-I53k/sendMessage?chat_id={BLOCKED}267006

Andere Details

Es macht Folgendes:

• It disguises itself as a login page to access a document.
  
• It connects to the following URLs for images displayed inside the webpage:
  • https://{BLOCKED}b.co/jWpqmNr/photo-2023-03-14-13-24-45.jpg
  • https://{BLOCKED}ons.com/files/icons/2795/office_2013_hd/2000/excel.png
  • https://{BLOCKED}ns-png.flaticon.com/512/2223/2223615.png
• On first and second login attempt, it will forcibly display an error.
• On the third login attempt, the webpage will be redirected to the following URL:
  • https://{BLOCKED}k.office.com/mail/l