Trojan.PHP.MAILER.C

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Propagation

This Trojan does not have any propagation routine.

Backdoor Routine

This Trojan does not have any backdoor routine.

Rootkit Capabilities

This Trojan does not have rootkit capabilities.

Dropping Routine

This Trojan drops the following files:

• {Malware File Path}\out.php → contains list of email addresses to where the created email was sent

Information Theft

This Trojan gathers the following data:

• Web form data
• Client IP address
• Client hostname
• Server name

Other Details

This Trojan does the following:

• It enables its user to create and send an e-mail to target e-mail addresses using PHP library.
• It uses the following web form to input custom information for e-mail creation purpose:
  
• It connects to the following URLs to identify the server's IP address's location:
  • http://{BLOCKED}geo.com/api/index.php
• It sends the gathered information to a specific email address.

However, as of this writing, the said sites are inaccessible.

It does not exploit any vulnerability.

It requires being hosted on a web server in order to proceed with its intended routine.