Trojan.HTML.PHISH.ZX

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Este malware no tiene ninguna rutina de propagación.

Este malware no tiene ninguna rutina de puerta trasera.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Propagación

Este malware no tiene ninguna rutina de propagación.

Rutina de puerta trasera

Este malware no tiene ninguna rutina de puerta trasera.

Robo de información

Recopila los siguientes datos:

• Email
• Input Password
• Ip Address

Otros detalles

Hace lo siguiente:

• It disguises itself as a login page to dowload a document.
  
• After pressing the login button, it will display a fake loading animation.
  
• It connects to the following URL for images displayed inside the webpage:
  • https://{BLOCKED}abay.com/animation/2023/05/02/04/29/04-29-06-428_512.gif
  • https://{BLOCKED}ineaccess1.com/cdn/depot/5086/375/c35fffab53598af19c806a6ed9fdd068/assets/images/ncua_logo_large-4a4a13e41007adaf4841dd9e4b145458.png
  • https://{BLOCKED}ted-tbn0.gstatic.com/images?q=tbn:ANd9GcTSRaY-hxT2Sch-rV0Qml1uAmKth6ye-7hWcQ&s
  • https://{BLOCKED}stockphoto.com/id/1298834280/vector/pdf-icon-major-file-format-vector-icon-illustration.jpg
• It sends an HTTP GET request to the following URL, appending the Base64-encoded stolen information:
  • https://{BLOCKED}porno.fr/wp-content/plugins/0fbe362603c542cab27f229ee46f953a/xt/mmd/ALLBNK/push.php?data={base 64 encoded information}
  • It returns a response based on the password field:
  • error → If there is no input in the password field
  • Reset Password field
  • Display error message
  • success
  • It will be redirected to the following URL (tracked as non-malicious):
  • https://{BLOCKED}do.go.jp