Trojan.HTML.PHISH.VSNTJK22

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Robo de información

Recopila los siguientes datos:

• Specific Email
• Input Password

Información sustraída

Este malware envía la información recopilada a la siguiente URL a través de HTTP POST:

• https://{BLOCKED}-form.com/9TC5TMBo

Otros detalles

Hace lo siguiente:

• It disguises itself as a login page to access a document
  
• It connects to the following URLs for images displayed inside the webpage:
  • https://{BLOCKED}7.{BLOCKED}g.com/pngimages/571/47/png-clipart-adobe-acrobat-pdf-computer-icons-adobe-reader-edu-invest-adobe-pdf-text-logo-thumbnail.png
• After sending the user credentials, the webpage will be redirected to the following URL (tracked as non-malicious):
  • https://www.outlook.com/mail/0?email={BLOCKED}