Trojan.HTML.PHISH.SMTPTCVBB

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Diese Malware hat keine Verbreitungsroutine.

Diese Malware hat keine Backdoor-Routine.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Verbreitung

Diese Malware hat keine Verbreitungsroutine.

Backdoor-Routine

Diese Malware hat keine Backdoor-Routine.

Entwendete Daten

Sendet die gesammelten Daten über HTTP-POST an den folgenden URL:

• https://{BLOCKED}z.lk/script.php
  • which sends the following information using the "data" parameter:
    • username → victim's email address
    • password → input password
    • to → {BLOCKED}onway404@gmail.com (attacker's email address}
    • subject → "{Empty string}" (on 1st submission) | " - Second Try" (on 2nd submission)
• However, as of this writing, the said site is inaccessible.

Andere Details

Es macht Folgendes:

• It disguises itself as a login page to deceive the user into providing their password:
  
• It connects to the following URLs to display images and load resources inside the webpage:
  • https://{BLOCKED}oogleapis.com/css?family=Roboto:100,400,500,700
  • https://{BLOCKED}uery.com/jquery-3.5.1.min.js
  • https://{BLOCKED}ckspace.com/favicon.ico
  • https://{BLOCKED}n.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
  • https://{BLOCKED}eraccess.com/full/3309609.jpg
    hyperlink that contains the following legitimate URL:
    • https://{BLOCKED}elp.rackspace.com/l/identify-suspicious-email
• After the initial load, the current URL in the address bar is replaced with a spoofed URL that includes the parameters scriptID, cookies, and token, formatted as follows:
  • {Current URL}?scriptID={ScriptId}&cookies={Cookies}&token={Token}
    where:
    • ScriptId → random number between 0 and 999,999,999,999,998
    • Cookies → Base64-encoded random number
    • Token → random number
• It changes the page title into the following:
  • Rackspace Webmail: Hosted Email for Business
• After the 1st login attempt, it displays the following fake error message:
  • 入力したパスワードが正しくありません → translates to: "The password you entered is incorrect."
    then reloads the page with the following URL:
    • {Spoofed URL}&sec_p=09304 → indicating the page is in 2nd login attempt
• After the 2nd login attempt, it redirects to the following legitimate URL:
  • http://google.jp