Trojan-Banker.Win32.Banker.asq

Technical Details

This Trojan will steal confidential user data when the user visits certain websites. It is a Windows PE EXE file. The file is 62,476 bytes in size. It is packed using Upack. The unpacked file is approximately 319KB in size. It is written in Borland C++.

Installation

When launched, the Trojan will copy its executable file as:

The original Trojan file will then be deleted.

In order to ensure that the Trojan is launched automatically each time Windows is restarted, the Trojan registers its executable file in the system registry:

Payload

The Trojan uses a Browser Helper Object to track user activity within Internet Explorer.

The Trojan protocols the following user actions:

• opening URLs
• Actions which the user carries out with web form components - tracking the user’s choice of radio buttons, checkboxes, keys pressed, component names. The Trojan sends this information to the remote malicious user’s site.
• If the user enters information in a text field with one of the names listed below, the information will be sent to the remote malicious user’s site.

  answer
  cajamadrid
  ccpin
  citibank
  clave
  ClaveAcceso_s
  cliente
  codigo
  D1
  D33
  Documento_s
  firma
  firma
  Firma1
  identifica
  key
  logonID
  memorable
  NumeroCliente_s
  NumeroUsuario_s
  parol
  pass
  passphrase
  passwd
  passwd
  passwd2
  password
  Password
  password
  pasw
  pin
  pin2
  pwd
  pwd2
  secret
  secur
  secure
  segur
  servicio
  tan
  tan2
  TipoId_s
  userid
  username

On web sites with addresses which contain the strings listed below (left hand column) the Trojan gets the information from the fields listed below (right hand column) and sends this information to the remote malicious user’s site.

The Trojan will also send information about the operating system version and screen resolution used to the remote malicious user.

The Trojan uses the WNetEnemCachedPasswords undocumented function to harvest all passwords which have been saved to the victim machine, and sends them to the remote malicious user's site.

from the following registry entry:

and sends them to the remote malicious user.

In order to transmit harvested information, the Trojan periodically connects to http://http.acid-burn.info/loger.php and transmits the harvested information as HTTP request parameters.

Removal instructions

1. Use Task Manager to terminate the Trojan process (it may be called scvhost.exe)
2. Delete the following file:
   %System%\scvhost.exe
3. Delete the following system registry key parameter:
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   Internet Explorer Helper="%System%\scvhost.exe"
4. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus.)