Search

like citing current events such as the Covid-19 pandemic to grab the receiver’s attention. The download URL structure, technique used, and macro code is similar to that of a campaign that delivers

user to re-enter their credentials It redirects the webpage to the following URL after sending the user credentials the second time: http://www.{Email Domain} It does not exploit any vulnerability.

following: This backdoor connects to the following URL through UDP communication to get and execute arbitrary codes: {BLOCKED}ge.3057441.ns1.microsoftdata.site However, as of this writing, the said sites are

following: This backdoor connects to the following URL through UDP communication to get and execute arbitrary codes: {BLOCKED}ge.3057441.ns1.microsoftdata.site However, as of this writing, the said sites are

https://{BLOCKED}earbit.com/c-a-c.jp http://www.{BLOCKED}3.org/2000/svg However, as of this writing, the first URL listed is inaccessible. It does not exploit any vulnerability. Trojan:HTML/Phish.MAB!MTB

!api/2.0/snippets/lulimpishtum/aqqApa/ae9f1bacccbf90b8221f755a259d1cddb270c79b/files/file Other Details This Trojan connects to the following URL(s) to get the affected system's IP address: https://{BLOCKED}ig.me/ip It does the following: It connects to the following URL to get the

Profile URL Session ID Username Verification Status Reddit Coins Comment Karma Email Gold Status Moderator Status Profile Picture Profile URL Total Karma Username Roblox Email Email Verification Status

\Software\Microsoft\ Internet Account Manager\Accounts\Bigfoot LDAP Server = "ldap.bigfoot.com" HKEY_CURRENT_USER\Software\Microsoft\ Internet Account Manager\Accounts\Bigfoot LDAP URL = "http://www.{BLOCKED

\Software\Microsoft\ Internet Account Manager\Accounts\Bigfoot LDAP Server = "ldap.bigfoot.com" HKEY_CURRENT_USER\Software\Microsoft\ Internet Account Manager\Accounts\Bigfoot LDAP URL = "http://www.{BLOCKED

\Software\Microsoft\ Internet Account Manager\Accounts\Bigfoot LDAP Server = "ldap.bigfoot.com" HKEY_CURRENT_USER\Software\Microsoft\ Internet Account Manager\Accounts\Bigfoot LDAP URL = "http://www.{BLOCKED

\Software\Microsoft\ Internet Account Manager\Accounts\Bigfoot LDAP Server = "ldap.bigfoot.com" HKEY_CURRENT_USER\Software\Microsoft\ Internet Account Manager\Accounts\Bigfoot LDAP URL = "http://www.{BLOCKED

\Software\Microsoft\ Internet Account Manager\Accounts\Bigfoot LDAP Server = "ldap.bigfoot.com" HKEY_CURRENT_USER\Software\Microsoft\ Internet Account Manager\Accounts\Bigfoot LDAP URL = "http://www.{BLOCKED

\Software\Microsoft\ Internet Account Manager\Accounts\Bigfoot LDAP Server = "ldap.bigfoot.com" HKEY_CURRENT_USER\Software\Microsoft\ Internet Account Manager\Accounts\Bigfoot LDAP URL = "http://www.{BLOCKED

the following URL and renames the file when stored in the affected system: %Application Data%\Microsoft\f0xyupdate.exe - TROJ_LISHCA.C (Note: %Application Data% is the Application Data folder, where it

" Other Details This Trojan does the following: accesses the following URL to download a file if {Directory of Java Runtime Environment}\bin\javaw.exe version is not 1.6, 1.7, 1.8 or if {Directory of Java

\windows\Rass Action: powershell -nop -ep bypass -e {Base-64 encoded} Uses the following URL to get the public IP address: https://api.ipify.org/ It will Scan range of IP addresses available on the machine.

\wuapp.exe Terminates its coin mining component if the following process is found: taskmgr.exe Connects to the following URL to get the configuration file for its coin mining component: http://{BLOCKED

{BLOCKED}e.qq.com/946851661 http://{BLOCKED}r.{BLOCKED}6.tk http://{BLOCKED}s.{BLOCKED}8.com Information Theft This backdoor s configuration file contains the following information: C&C Server / URL title of

URL to the URL http://javadl.sun.com/webapps/download/AutoDL?BundleId=76867 to download a true Java installer. It drops and execute the downloaded installer as %User Temp%\Java7u30_update.exe .

the initially executed copy of itself NOTES: This Trojan also accesses the URL {BLOCKED}.{BLOCKED}.99.70:12127/1102us21/{COMPUTER NAME}/0/{OS VERSION}/0/{ENCRYPTED IP} before download. It then accesses