Trojan.HTML.PHISH.VSNTJK22

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Datendiebstahl

Folgende Daten werden gesammelt:

• Specific Email
• Input Password

Entwendete Daten

Sendet die gesammelten Daten über HTTP-POST an den folgenden URL:

• https://{BLOCKED}-form.com/9TC5TMBo

Andere Details

Es macht Folgendes:

• It disguises itself as a login page to access a document
  
• It connects to the following URLs for images displayed inside the webpage:
  • https://{BLOCKED}7.{BLOCKED}g.com/pngimages/571/47/png-clipart-adobe-acrobat-pdf-computer-icons-adobe-reader-edu-invest-adobe-pdf-text-logo-thumbnail.png
• After sending the user credentials, the webpage will be redirected to the following URL (tracked as non-malicious):
  • https://www.outlook.com/mail/0?email={BLOCKED}