Reader Malware: ZIP/HTML Phish - SANS Internet Storm Center

Watch ISC TV. Great for NOCs, SOCs and Living Rooms: https://isctv.sans.edu

Handler on Duty: Johannes Ullrich

Threat Level: green

Reader Malware: ZIP/HTML Phish
Reader Henry submitted a malicious email attachment: a ZIP file. It contains a PNG file and a HTML file: The HTML file contains a script with hexadecimal code, that can be decoded with base64dump.py: This is a phishing site for Microsoft credentials, that starts with a captcha: There's something more to this zip file: that's for next diary entry. Didier Stevens Senior handler Microsoft MVP blog.DidierStevens.com	DidierStevens 678 Posts ISC Handler Oct 23rd 2021
Thread locked Subscribe	Oct 23rd 2021 11 months ago