TR/Spy.Banker.BAY - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/Spy.Banker.BAY
Date discovered:	02/10/2006
Type:	Trojan
In the wild:	No
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Medium
Static file:	Yes
File size:	294.792 Bytes
MD5 checksum:	48913bbd9f747a27e747685c445fc84e
VDF version:	6.36.00.71 - Mon, 02 Oct 2006 10:14 (GMT+1)
IVDF version:	6.36.00.86 - Mon, 09 Oct 2006 19:48 (GMT+1)

General Method of propagation:
   • No own spreading routine

Aliases:
   • Kaspersky: Trojan-Spy.Win32.Banker.cbk
   • F-Secure: Trojan-Spy.Win32.Banker.cbk
   • Grisoft: PSW.Banker
   • Eset: Win32/Spy.Banker.AHY

Platforms / OS:
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Registry modification
   • Steals information

Files It copies itself to the following locations:
• %ALLUSERSPROFILE%\start menu\programs\startup\Windows Update.exe
• %SYSDIR%\Windows Update.exe

Registry The following registry key is added in order to run the process after reboot:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• "Winconfig"="%SYSDIR%\Windows Update.exe"

Email It doesn't have its own spreading routine but it has the ability to send an email. It is most likely that the receiver is the author. The characteristics are described below:

From:
The sender address is spoofed.
The sender of the email is one of the following:
   • ATIVADO! %computer name%
   • $$$$ CEF

To:
The recipients of the email are the following:
   • newfamilyxxxx1@gmail.com
   • infossss@gmail.com

Email design:

From: ATIVADO! %computer name%
To: newfamilyxxxx1@gmail.com

From: $$$$ CEF
To: newfamilyxxxx1@gmail.com
Subject: CHEGOU UMA INFO CEF
Body:
   • [+] Tipo...........: %stolen information%
     [+] Agência........: %stolen information%
     [+] Conta..........: %stolen information%
     [+] Senha NET......: %stolen information%
     [+] Ass. Eletrônica: %stolen information%

The email looks like the following:

Mailing MX Server:
It has the ability to contact the MX server:
• gsmtp185.google.com

Stealing It tries to steal the following information:

– A logging routine is started after a website is visited:
• https://internetcaixa.caixa.gov.br/NASApp/SIIBC/saldo.processa

– It captures:
• Login information

–Form windows are displayed as shown in the pictures below:

Miscellaneous Mutex:
It creates the following Mutex:
• DsKmSk MuTexXx

File details Programming language:
The malware program was written in Delphi.

Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• PEtite

See a brief description here.

Description inserted by Adriana Popa on Mon, 09 Oct 2006 10:48 (GMT+1)
Description updated by Adriana Popa on Mon, 09 Oct 2006 16:02 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back