Trojan.HTML.PHISH.FO

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Este malware no tiene ninguna rutina de propagación.

Este malware no tiene ninguna rutina de puerta trasera.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Propagación

Este malware no tiene ninguna rutina de propagación.

Rutina de puerta trasera

Este malware no tiene ninguna rutina de puerta trasera.

Robo de información

Recopila los siguientes datos:

• Specific Email
• Input Password

Información sustraída

Este malware envía la información recopilada a la siguiente URL a través de HTTP POST:

• http://22.{BLOCKED}ss.com//wp-includes/IXR/ORDER/awoko.php

Otros detalles

Hace lo siguiente:

• It disguises itself as a login page to access a document:
  
  • Clicking the 'Open' button reveals the login form to input the user credentials.
• It connects to the following URLs to display images inside the webpage:
  • https://i.{BLOCKED}/934cee31d5268a86c613c5ac8999f886.png
  • https://{BLOCKED}.net/wp-content/uploads/2022/02/Microsoft-Excel-Symbol.png
  • https://{BLOCKED}.com/I6kN-6X7nhAAAAAj/loading-buffering.gif
• After sending the user credentials, the webpage will be redirected to the following URL:
  • https://{BLOCKED}.com/864663fe4e09146419bb8a9509b320e1.png