Symantec analyzed the malware and found its behavior to be as follows:
- The malware consists of two executable files that both perform the same action.
- The files are added to the registry run key, which executes after every reboot.
- The malware sets up a key logger in order to track anything that the victim types.
- Then, it will check if there is Internet connectivity by pinging www.google.com. If there is connectivity, the malware will send all information gathered to the attacker’s email address.
- Symantec observed that the email address has not been valid for three months and, hence, the malware is not able to send updates to the attacker at the moment.
- If users fell victim to the phishing site by entering their login credentials, the phishers would have successfully stolen their information for identity theft purposes.
Source. Via AllFacebook