Trojan.HTML.PHISH.HB

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Este malware no tiene ninguna rutina de propagación.

Este malware no tiene ninguna rutina de puerta trasera.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Propagación

Este malware no tiene ninguna rutina de propagación.

Rutina de puerta trasera

Este malware no tiene ninguna rutina de puerta trasera.

Robo de información

Recopila los siguientes datos:

• Specific email
• Input password

Información sustraída

Este malware envía la información recopilada a la siguiente URL a través de HTTP POST:

• https://{BLOCKED}mag.com/aceed/ona.php

  However, as of this writing, the said sites are inaccessible.

Otros detalles

Hace lo siguiente:

• It disguises itself as a login page to access a document:
  
• It connects to the following URLs to display images inside the webpage:
  • https://{BLOCKED}atvijaybajaj.in/download.svg
  • https://{BLOCKED}-force.000webhostapp.com/oneb.PNG
• When the user tries to log in more than twice, the webpage will be redirected to the following URL:
  • https://{BLOCKED}ve.live.com/