Trojan.HTML.PHISH.JB

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Diese Malware hat keine Verbreitungsroutine.

Diese Malware hat keine Backdoor-Routine.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Verbreitung

Diese Malware hat keine Verbreitungsroutine.

Backdoor-Routine

Diese Malware hat keine Backdoor-Routine.

Datendiebstahl

Folgende Daten werden gesammelt:

• Specific Email
• Input Password

Entwendete Daten

Sendet die gesammelten Daten über HTTP-POST an den folgenden URL:

• https://{BLOCKED}madu.org/milo/auth.php

Andere Details

Es macht Folgendes:

• It disguises itself as a login page to access a document:
  
• It connects to the following URL for images displayed inside the webpage:
  • https://{BLOCKED}b.co/LzTQVcnV/background.png
• It displays an error message if the input password is blank or contains whitespace.
• It displays an error message if the submit count is less than or equal to two.
• It redirects the web browser to the following URL if the submit count is more than two (tracked as non-malicious):
  • {BLOCKED}onsteel.com