TR/Spy.Banker.GN.118784 - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/Spy.Banker.GN.118784
Date discovered:	02/11/2006
Type:	Trojan
In the wild:	No
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Low to medium
Static file:	Yes
File size:	118.784 Bytes
MD5 checksum:	b555647ee3464114a5c2d43b0b470799
VDF version:	6.36.00.150
IVDF version:	6.36.00.167 - Wed, 25 Oct 2006 16:56 (GMT+1)

General Method of propagation:
   • No own spreading routine

Aliases:
   • Kaspersky: Trojan-Spy.Win32.Bancos.yt
   • Sophos: Mal/VBBanc-A
   • Grisoft: PSW.Banker2.STH
   • Eset: Win32/Spy.Bancos.U
   • Bitdefender: Generic.Banker.VB.C4AE81C9

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Downloads files
   • Registry modification
   • Steals information

Files It copies itself to the following location:
   • %SYSDIR%\tasklist32.exe

It tries to download some files:

– The location is the following:
   • http://www.pcmicro01.vila.bol.com.br/**********
This file may contain further download locations and might serve as source for new threats.

– The location is the following:
   • http://www.pcmicro01.vila.bol.com.br/beto1/**********
This file may contain further download locations and might serve as source for new threats.

Registry The following registry key is continuously in an infinite loop added in order to run the process after reboot.

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "TaskList"="\"%SYSDIR%\tasklist32.exe\""

The following registry key is added:

– [HKLM\SOFTWARE\INTEL\LANDesk\VirusProtect6\CurrentVersion\Storages\
   InternetMail\RealTimeScan]
   • "OnOff"=dword:00000000

Email It doesn't have its own spreading routine but it has the ability to send an email. It is most likely that the receiver is the author. The characteristics are described below:

From:
The sender of the email is the following:
   • antonioautentica@yahoo.com.br

To:
The recipients of the email are the following:
   • williansantunes@bol.com.br
   • pulse@bol.com.br

Subject:
The following:
   • Nova Coleta ! %current date% %current time%

Body:
–  It is constructed using a regular expression.
The body of the email is the following:

   • %random character string%

Continued by the following:

   • Msg da versão.: %version number% OR - %number%-Erro no arquivo

The email looks like the following:

Stealing It tries to steal the following information:
– Passwords typed into 'password input fields'

– A logging routine is started after one of the following websites are visited:
   • www2.bancobrasil.com.br
   • https://www2.bancobrasil.com.br/aapf/saldos/006.jsp?codT=0
   • https://www2.bancosbrasil.com.br/aapff/aaii/principal
   • http://www.internetcaixa.caixa.gov.br
   • https://bankline.itau.com.br/GRIPNET/gracgi.exe
   • http://www.bankline.itau.com.br

– It captures:
    • Window information
    • Login information

–A form window is displayed as shown in the picture below:

File details Programming language:
The malware program was written in Visual Basic.

Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• PE Compact

See a brief description here.

Description inserted by Monica Ghitun on Thu, 02 Nov 2006 14:54 (GMT+1)
Description updated by Monica Ghitun on Tue, 21 Nov 2006 15:39 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back