HTML_MALPHISH.ANF

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Propagation

This Trojan does not have any propagation routine.

Backdoor Routine

This Trojan does not have any backdoor routine.

Other Details

This Trojan does the following:

• Upon the execution of the file, it displays the following page, which shows fake details to trick users on clicking the fake PDF image:

  

• After the user clicks the fake PDF image on the page, this pop-up window will be displayed:

  

• The displayed pop-up window contains textbox for username/email and password.
• Upon clicking the "Download File" button on the pop-up window, the malware will connect to this malicious URL to send the stolen information (username and password input by the user):
  • http://www.{BLOCKED}mastery.com/ugo/file/log.php
    Where the data sent is in the following format:
    • feedback={Username/Email}&feedbacknow={Password}
  
  However, as of this writing, the said sites are inaccessible.
• After the following routines above, the user will be automatically redirected to the legitimate Microsoft Live Login Page, to hide all the malicious routines done by the malware above.

NOTES:
The malware also uses the following sites to get the images/logos used on the displayed webpage as part of its phishing routine: