TR/Spy.Banker.aca - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/Spy.Banker.aca
Date discovered:	26/08/2005
Type:	Trojan
Subtype:	spyware
In the wild:	No
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Medium
Static file:	Yes
File size:	1,249,855 Bytes
MD5 checksum:	a663d38656dcbfd49a99cd6a997b2eb9
VDF version:	6.31.1.186

General Method of propagation:
   • No own spreading routine

Alias:
   • Mcafee: PWS-Banker.gen.bb
   • Kaspersky: Trojan-Spy.Win32.Banker.aca
   • Sophos: Troj/Bancban-ES

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Records keystrokes
   • Registry modification
   • Steals information

Files It copies itself to the following location:
• %WINDIR%\Config\svchost.exe

Registry The following registry key is added in order to run the process after reboot:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• "svchost"="c:\windows\\config\\svchost.exe"

Email It doesn't have its own spreading routine but it has the ability to send an email. It is most likely that the receiver is the author. The characteristics are described below:

Email design:

From: Makina:%computer name%
To: bl4d3xcool2@gmail.com
Subject: %computer name% Infectado
Body:
   • Nome do Computador: %computer name% Infected
     IP: %current ip address%
     Data: %current date%
     Hora: %current time%

From: PC:%computer name%
To: bl4d3xcool2@gmail.com
Subject: Banrisul
Body:
   • <Kl built in: %current date%-------------->
     --------------> Info`z <---------------
     Nome do Computador: %computer name%
     IP: %current ip address%
     Data: %current date% Hora: %current time%
     ------------> Banrisul <--------------
     BANRISUL Agencia=%stolen information%
     BANRISUL Conta=%stolen information%
     BANRISUL Senha=%stolen information%
     BANRISUL Senha Complementar=%stolen information%

From: PC:%computer name%
To: bl4d3xcool2@gmail.com
Subject: Bradesco
Body:
   • <Kl built in: %current date%-------------->
     --------------> Info`z <---------------
     Nome do Computador: %computer name%
     IP: %current ip address%
     Data: %current date% Hora: %current time%
     -------------> Bradesco <--------------
     BRADESCO Agencia :%stolen information%
     BRADESCO Conta :%stolen information%
     BRADESCO Tipo de conta:%stolen information%
     BRADESCO S. 4 digitos:%stolen information%
     BRADESCO Resposta secreta:%stolen information%
     BRADESCO S. Cartao de Debito:%stolen information%
     BRADESCO CPF:%stolen information%
     BRADESCO Data de nascimento:%stolen information%
     BRADESCO RG:%stolen information%

From: PC:%computer name%
To: bl4d3xcool2@gmail.com
Subject: Unibanco
Body:
   • <Kl built in: %current date%-------------->
     --------------> Info`z <---------------
     Nome do Computador: %computer name%
     IP: %current ip address%
     Data: %current date% Hora: %current time%
     -------------> Unibanco <-------------
     UNIBANCO AG=%stolen information%
     UNIBANCO Conta=%stolen information%
     UNIBANCO Digito=%stolen information%
     UNIBANCO Senha CC=%stolen information%
     UNIBANCO Ass. Eletronica=%stolen information%

From: PC:%computer name%
To: bl4d3xcool2@gmail.com
Subject: Unibanco Empresa
Body:
   • <Kl built in: %current date%-------------->
     --------------> Info`z <---------------
     Nome do Computador: %computer name%
     IP: %current ip address%
     Data: %current date% Hora: %current time%
     ----------> Unibanco Empresa <---------
     UNIBANCO Apelido=%stolen information%

From: PC:%computer name%
To: bl4d3xcool2@gmail.com
Subject: Banco Estadual do Cear
Body:
   • <Kl built in: %current date%-------------->
     --------------> Info`z <---------------
     Nome do Computador: %computer name%
     IP: %current ip address%
     Data: %current date% Hora: %current time%
     ------->>> Banco Estadual do Cear <<-------
     BEC Agencia:%stolen information%
     BEC Conta:%stolen information%
     BEC Digito:%stolen information%
     BEC Senha NET:%stolen information%
     BEC Resposta:%stolen information%

From: PC:%computer name%
To: bl4d3xcool2@gmail.com
Subject: Banco de Brasilia
Body:
   • <Kl built in: %current date%-------------->
     --------------> Info`z <---------------
     Nome do Computador: %computer name%
     IP: %current ip address%
     Data: %current date% Hora: %current time%
     ----------------> BRB <----------------
     BRB Usuario=%stolen information%
     BRB Conta=%stolen information%
     BRB Senha=%stolen information%
     BRB Senha AE=%stolen information%

From: PC:%computer name%
To: bl4d3xcool2@gmail.com
Subject: Nossa Caixa
Body:
   • <Kl built in: %current date%-------------->
     --------------> Info`z <---------------
     Nome do Computador: %computer name%
     IP: %current ip address%
     Data: %current date% Hora: %current time%
     -----------> Nossa Caixa <-------------
     NOSSACEF Agencia=%stolen information%
     NOSSACEF Digito Agencia=%stolen information%
     NOSSACEF Conta=%stolen information%
     NOSSACEF Digito Conta=%stolen information%
     NOSSACEF Ass Eletronica=%stolen information%
     NOSSACEF Nome=%stolen information%
     NOSSACEF Senha=%stolen information%

From: PC:%computer name%
To: bl4d3xcool2@gmail.com
Subject: Real
Body:
   • <Kl built in: %current date%-------------->
     --------------> Info`z <---------------
     Nome do Computador: %computer name%
     IP: %current ip address%
     Data: %current date% Hora: %current time%
     ---------------> Real <----------------
     REAL Login=%stolen information%
     REAL AG=%stolen information%
     REAL Conta=%stolen information%
     REAL Senha NET=%stolen information%
     REAL Senha CC=%stolen information%

From: PC:%computer name%
To: bl4d3xcool2@gmail.com
Subject: Santander
Body:
   • <Kl built in: %current date%-------------->
     --------------> Info`z <---------------
     Nome do Computador: %computer name%
     IP: %current ip address%
     Data: %current date% Hora: %current time%
     ------------> Santander <-------------
     SANTANDER User=%stolen information%
     SANTANDER Agencia=%stolen information%
     SANTANDER Conta=%stolen information%
     SANTANDER 4 digitos=%stolen information%
     SANTANDER Ass. Eletronica=%stolen information%

From: PC:%computer name%
To: bl4d3xcool2@gmail.com
Subject: Banco do Nordeste
Body:
   • <Kl built in: %current date%-------------->
     --------------> Info`z <---------------
     Nome do Computador: %computer name%
     IP: %current ip address%
     Data: %current date% Hora: %current time%
     --------> Banco do Nordeste <---------
     NORDESTE Usuario:%stolen information%
     NORDESTE Agencia:%stolen information%
     NORDESTE Conta:%stolen information%
     NORDESTE Digito:%stolen information%
     NORDESTE S.Atend:%stolen information%
     NORDESTE Cartao:%stolen information%

From: PC:%computer name%
To: bl4d3xcool2@gmail.com
Subject: Banespa
Body:
   • <Kl built in: %current date%-------------->
     --------------> Info`z <---------------
     Nome do Computador: %computer name%
     IP: %current ip address%
     Data: %current date% Hora: %current time%
     -------------> Banespa <--------------
     BANESPA Usuario:%stolen information%
     BANESPA Agencia:%stolen information%
     BANESPA Conta:%stolen information%
     BANESPA Digito:%stolen information%
     BANESPA S.Atend:%stolen information%
     BANESPA Cartao:%stolen information%

From: PC:%computer name%
To: bl4d3xcool2@gmail.com
Subject: Banco Rural
Body:
   • <Kl built in: %current date%-------------->
     --------------> Info`z <---------------
     Nome do Computador: %computer name%
     IP: %current ip address%
     Data: %current date% Hora: %current time%
     -----------> Banco Rural <------------
     RURAL Usuario:%stolen information%
     RURAL Senha:%stolen information%
     RURAL Agencia:%stolen information%
     RURAL Tipo:%stolen information%
     RURAL Conta Corrente:%stolen information%
     RURAL Digito:%stolen information%

From: PC:%computer name%
To: bl4d3xcool2@gmail.com
Subject: Gerenciador Financeiro
Body:
   • <Kl built in: %current date%-------------->
     --------------> Info`z <---------------
     Nome do Computador: %computer name%
     IP: %current ip address%
     Data: %current date% Hora: %current time%
     ---------> Gerenciador Financeiro <---------
     GF CHAVE ACESSO:%stolen information%
     GF SENHA ACESSO:%stolen information%
     GF AGENCIA:%stolen information%
     GF CONTA CORRENTE:%stolen information%
     GF SENHA 8 DIG:%stolen information%
     --------------------------------------------

From: PC:%computer name%
To: bl4d3xcool2@gmail.com
Subject: Ita
Body:
   • <Kl built in: %current date%-------------->
     --------------> Info`z <---------------
     Nome do Computador: %computer name%
     IP: %current ip address%
     Data: %current date% Hora: %current time%
     ---------------> Ita <---------------
     ITAU Agencia:%stolen information%
     ITAU Conta:%stolen information%
     ITAU Senha internet:%stolen information%
     ITAU Senha do cartao:%stolen information%
     ITAU 5 digitos do cartao:%stolen information%
     ITAU Senha eletronica:%stolen information%
     ITAU numero do portador:%stolen information%
     ITAU nascimento:%stolen information%
     PC:%stolen information%

From: PC:%computer name%
To: bl4d3xcool2@gmail.com
Subject: Caixa
Body:
   • <Kl built in: %current date%-------------->
     --------------> Info`z <---------------
     Nome do Computador: %computer name%
     IP: %current ip address%
     Data: %current date% Hora: %current time%
     --------------> Caixa <----------------
     CAIXA Tipo=%stolen information%
     CAIXA Agencia=%stolen information%
     CAIXA Conta=%stolen information%
     CAIXA S. Intermet=%stolen information%
     CAIXA Ass. Eletronica= %stolen information%

From: PC:%computer name%
To: bl4d3xcool2@gmail.com
Subject: BB
Body:
   • <Kl built in: %current date%-------------->
     --------------> Info`z <---------------
     Nome do Computador: %computer name%
     IP: %current ip address%
     Data: %current date% Hora: %current time%
     ---------------> BB <-----------------
     BB Titular:%stolen information%
     BB Agencia:%stolen information%
     BB Conta:%stolen information%
     BB Senha A.Atendimento:%stolen information%
     BB Senha Cartao:%stolen information%
     <------------------------------------->

The email may look like one of the following:

Mailing MX Server:
It has the ability to contact the MX server:
• smtp.isbt.com.br

Stealing – A logging routine is started after one of the following websites are visited:
   • wwws1.bec.com.br
   • banknet.brb.com.br/brbBanknet
   • banknet.brb.com.br/banknet
   • wwws.nossacaixa.com.br/bemvindo.asp
   • nel.bnb.gov.br
   • empresarial.unibanco.com.br/index.asp
   • ibpf.unibanco.com.br/index.asp
   • santandernet.com.br
   • www.realsecureweb.com.br/scripts/engine_brpi.dll
   • www2.realsecureweb.com.br/scripts/engine_brpi.dll
   • https://wwwss.bradesco.com.br - Bradesco Internet Banking
   • https://wwwss.bradesco.com.br/scripts/ib2k1.dll/LOGIN
   • https://ww4.banrisul.com.br/bto/link/msie/btope0hw.asp

– A logging routine is started after the following website is visited, which contains one of the following substrings in the URL:
   • itau
   • bradesco
   • realemp
   • banespa
   • santander
   • unibanco
   • uniempresa
   • caixa
   • real
   • bbjuridica
   • bec
   • brb
   • nossacaixa
   • banrisul
   • nordeste
   • bancorural

– It captures:
    • Keystrokes
    • Login information

Miscellaneous Mutex:
It creates the following Mutex:
• STFK MutexXx

File details Programming language:
The malware program was written in Delphi.

Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• PEtite 2.2

See a brief description here.

Description inserted by Iulia Diaconescu on Mon, 29 Aug 2005 11:18 (GMT+1)
Description updated by Iulia Diaconescu on Mon, 19 Sep 2005 14:03 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back