Symantec analyzed the malware and found its behavior to be as follows:
- The malware consists of two executable files that both perform the same action.
- The files are added to the registry run key, which executes after every reboot.
- The malware sets up a key logger in order to track anything that the victim types.
- Then, it will check if there is Internet connectivity by pinging www.google.com. If there is connectivity, the malware will send all information gathered to the attacker’s email address.
- Symantec observed that the email address has not been valid for three months and, hence, the malware is not able to send updates to the attacker at the moment.
- If users fell victim to the phishing site by entering their login credentials, the phishers would have successfully stolen their information for identity theft purposes.
Source. Via AllFacebook
THANK YOU
ReplyDeleteTHANK YOUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
ReplyDelete