Trojan.HTML.PHISH.QURAAOOITW

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Este malware no tiene ninguna rutina de propagación.

Este malware no tiene ninguna rutina de puerta trasera.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Propagación

Este malware no tiene ninguna rutina de propagación.

Rutina de puerta trasera

Este malware no tiene ninguna rutina de puerta trasera.

Información sustraída

Este malware envía la información recopilada a la siguiente URL a través de HTTP POST:

• https://{BLOCKED}plumbing.mycustomerconnect.com/css/send2/mine-alex-cham.php
• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.42/cam.php

Otros detalles

Hace lo siguiente:

• It disguises itself as a login page to access a document.
  
• It connects to the following URLs for images displayed inside the webpage:
  • https://www.{BLOCKED}g.com/png/detail/177-1772936_arbys-logo-transparent-norton-security-logo-png.png
  • https://{BLOCKED}o.com/214d89a26f0ac918a09f216a1b0f97b4.png
  • https://{BLOCKED}r.com/rbrqQ1I.jpg
• On first and second login attempt, it will forcibly display a wrong password error.
• On the third login attempt, the webpage will be redirected to the domain of the email:
• https://{domain}