Trojan.HTML.PHISH.QURAAOOITW

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Diese Malware hat keine Verbreitungsroutine.

Diese Malware hat keine Backdoor-Routine.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Verbreitung

Diese Malware hat keine Verbreitungsroutine.

Backdoor-Routine

Diese Malware hat keine Backdoor-Routine.

Entwendete Daten

Sendet die gesammelten Daten über HTTP-POST an den folgenden URL:

• https://{BLOCKED}plumbing.mycustomerconnect.com/css/send2/mine-alex-cham.php
• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.42/cam.php

Andere Details

Es macht Folgendes:

• It disguises itself as a login page to access a document.
  
• It connects to the following URLs for images displayed inside the webpage:
  • https://www.{BLOCKED}g.com/png/detail/177-1772936_arbys-logo-transparent-norton-security-logo-png.png
  • https://{BLOCKED}o.com/214d89a26f0ac918a09f216a1b0f97b4.png
  • https://{BLOCKED}r.com/rbrqQ1I.jpg
• On first and second login attempt, it will forcibly display a wrong password error.
• On the third login attempt, the webpage will be redirected to the domain of the email:
• https://{domain}