Trojan.HTML.PHISH.QURAAOOITC

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Diese Malware hat keine Verbreitungsroutine.

Diese Malware hat keine Backdoor-Routine.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Verbreitung

Diese Malware hat keine Verbreitungsroutine.

Backdoor-Routine

Diese Malware hat keine Backdoor-Routine.

Entwendete Daten

Sendet die gesammelten Daten über HTTP-POST an den folgenden URL:

• https://{BLOCKED}essis.co.za/shre.1/shre1.php

Andere Details

Es macht Folgendes:

• It disguises itself as a login page to access a document in SharePoint
  
  
• It shows an error message on the initial submission of credentials and requests user to re-enter their credentials
  
• It redirects the webpage to the following URL after sending the user credentials the second time:
  • http://www.{Email Domain}