Analysis by: Jennifer Gumban
ALIASES:

Mal/Phish-A (Sophos)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

  TECHNICAL DETAILS

File Size: 367,265 bytes
File Type: HTML, HTM
Memory Resident: No
Initial Samples Received Date: 23 Jan 2017

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Other Details

This Trojan connects to the following possibly malicious URL:

  • http://{BLOCKED}.{BLOCKED}.34.161/ml/forums/tguy/31/excl/log.php

It does the following:

  • It displays a form where the user is requested to input credentials for authentication. It attempts to steal sensitive online information, such as user names and passwords. This routine risks the exposure of the user's account information, which may then lead to the unauthorized use of the stolen data.