TR/Banbra.CC - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/Banbra.CC
Date discovered:	15/09/2005
Type:	Trojan
In the wild:	No
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Medium
Static file:	Yes
File size:	1.378.304 Bytes
MD5 checksum:	14cb88866ff102d114d05cfd835f93d3
VDF version:	6.32.00.37 - Thu, 22 Sep 2005 12:43 (GMT+1)

General Method of propagation:
   • No own spreading routine

Alias:
   • Kaspersky: Virus.Win32.Parite.b

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Steals information

Email It doesn't have its own spreading routine but it has the ability to send an email. It is most likely that the receiver is the author. The characteristics are described below:

From:
The sender of the email is the following:
   • jjveneno@uol.com.br

To:
The recipient of the email is the following:
   • pescocomagro@ubbi.com.br

Subject:
The following:
   • V1.5 Vermelho Conta : %stolen information%

Body:
The body of the email is the following:

   • %stolen information%

The email looks like the following:

Mailing MX Server:
It does not use the standard MX server.
It has the ability to contact the MX server:
• smtp.uol.com.br

Stealing – A logging routine is started after one of the following websites are visited:
   • http://www.bancodobrasil.com.br/appbb/portal/index.jsp;
      http://www.bancobrasil.com.br/appbb/portal/index.jsp;
      http://bancodobrasil.com.br/appbb/portal/index.jsp;
      http://bancobrasil.com.br/appbb/portal/index.jsp;
      http://www.bb.com.br/appbb/portal/index.jsp;
      http://www.bradesco.com.br; http://www.bradesco.com.br/;
      http://www.caixa.com.br/; http://www.caixa.com.br;
      http://www.caixa.gov.br; http://www.caixaeconomica.com.br;
      http://www.caixaeconomica.gov.br;
      http://www.caixaeconomicafederal.com.br;
      http://www.caixaeconomicafederal.gov.br; http://www.cef.com.br;
      http://www.cef.gov.br; http://www.itau.com.br/;
      http://www.itau.com.br; http://www.itau.com.br/indexIE.htm;
      http://www.serasa.com.br/; http://www.serasa.com.br;
      http://www.bancoreal.com.br/;
      https://internetcaixa.caixa.gov.br/_images/banner02.gif;
      http://www.itau.com.br/indexIE.htm

– A logging routine is started after the following website is visited, which contains one of the following substrings in the URL:
   • Banco Bradesco S/A
   • Caixa Econ
   • mica Federal
   • Banco Ita
   • Serasa S.A.
   • Gerenciador Financeiro
   • Banco ABN AMRO REAL
   • Portal Brasil

– It captures:
    • Login information

File details Programming language:
The malware program was written in Delphi.

Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• PECompact 2

See a brief description here.

Description inserted by Razvan Olteanu on Thu, 15 Sep 2005 16:37 (GMT+1)
Description updated by Oliver Auerbach on Thu, 22 Sep 2005 12:16 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back