Trojan.HTML.PHISH.SMTPTCVBB

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Este malware no tiene ninguna rutina de propagación.

Este malware no tiene ninguna rutina de puerta trasera.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Propagación

Este malware no tiene ninguna rutina de propagación.

Rutina de puerta trasera

Este malware no tiene ninguna rutina de puerta trasera.

Información sustraída

Este malware envía la información recopilada a la siguiente URL a través de HTTP POST:

• https://{BLOCKED}z.lk/script.php
  • which sends the following information using the "data" parameter:
    • username → victim's email address
    • password → input password
    • to → {BLOCKED}onway404@gmail.com (attacker's email address}
    • subject → "{Empty string}" (on 1st submission) | " - Second Try" (on 2nd submission)
• However, as of this writing, the said site is inaccessible.

Otros detalles

Hace lo siguiente:

• It disguises itself as a login page to deceive the user into providing their password:
  
• It connects to the following URLs to display images and load resources inside the webpage:
  • https://{BLOCKED}oogleapis.com/css?family=Roboto:100,400,500,700
  • https://{BLOCKED}uery.com/jquery-3.5.1.min.js
  • https://{BLOCKED}ckspace.com/favicon.ico
  • https://{BLOCKED}n.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
  • https://{BLOCKED}eraccess.com/full/3309609.jpg
    hyperlink that contains the following legitimate URL:
    • https://{BLOCKED}elp.rackspace.com/l/identify-suspicious-email
• After the initial load, the current URL in the address bar is replaced with a spoofed URL that includes the parameters scriptID, cookies, and token, formatted as follows:
  • {Current URL}?scriptID={ScriptId}&cookies={Cookies}&token={Token}
    where:
    • ScriptId → random number between 0 and 999,999,999,999,998
    • Cookies → Base64-encoded random number
    • Token → random number
• It changes the page title into the following:
  • Rackspace Webmail: Hosted Email for Business
• After the 1st login attempt, it displays the following fake error message:
  • 入力したパスワードが正しくありません → translates to: "The password you entered is incorrect."
    then reloads the page with the following URL:
    • {Spoofed URL}&sec_p=09304 → indicating the page is in 2nd login attempt
• After the 2nd login attempt, it redirects to the following legitimate URL:
  • http://google.jp