Trojan-Banker.Win32.Banker.ckj

Technical Details

This Trojan intercepts confidential user data. It is a Windows PE EXE file, 29KB in size, packed using MEW. The unpacked file is approximately 225KB in size.

Installation

When launched, the Trojan extracts from itself the following file, which is 41,472 bytes in size:

%System%\msie.dll

The Trojan also registers this file in the system registry, ensuring that it will be launched each time Windows is booted on the victim machine:

The Trojan then deletes its executable file and ceases running.

Payload

The Trojan component %System%\msie.dll installs hooks for the following API functions:

InternetCrackUrl
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetReadFile

The Trojan uses these hooks to track user activity on the following sites:

On these sites, the Trojan will intercept information values entered in fields with the following names:

AccountID
StoreMyNumber
PassPhrase
Turing
Amount
autoT1
autoT2
Id
Payee_Account
Login
Spend
Schmetterling

The Trojan also harvests Microsoft Office account passwords..

The Trojan saves harvested data to the following log files:

%System%\info.dat
%System%\ms.dat

These files are periodically uploaded to the remote malicious user’s FTP server.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the Trojan process.
2. Delete the original Trojan file (its location will depend on how the program originally penetrated the victim machine).
3. Delete the following files:

   %System%\msie.dll 
   %System%\info.dat 
   %System%\ms.dat

4. Delete the following registry key parameter:

   [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
   "AppInit_DLLs" = "%System%\msie.dll"

5. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).