Trojan.PHP.MAILER.C

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Este malware no tiene ninguna rutina de propagación.

Este malware no tiene ninguna rutina de puerta trasera.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Propagación

Este malware no tiene ninguna rutina de propagación.

Rutina de puerta trasera

Este malware no tiene ninguna rutina de puerta trasera.

Rutina de infiltración

Infiltra los archivos siguientes:

• {Malware File Path}\out.php → contains list of email addresses to where the created email was sent

Robo de información

Recopila los siguientes datos:

• Web form data
• Client IP address
• Client hostname
• Server name

Otros detalles

Hace lo siguiente:

• It enables its user to create and send an e-mail to target e-mail addresses using PHP library.
• It uses the following web form to input custom information for e-mail creation purpose:
  
• It connects to the following URLs to identify the server's IP address's location:
  • http://{BLOCKED}geo.com/api/index.php
• It sends the gathered information to a specific email address.