Trojan-Banker.Win32.Banker.cmb

Technical Details

This Trojan program is designed to steal confidential data. It is a Windows PE EXE file, and is 34304 bytes in size. It is packed using a customized packer.

The Trojan copies itself to

%sysdir%\ntos.exe

with system, read only and archive attributes.

When copying it appends random-sized junk to the end of its file in an attempt to make detection more difficult. It does not modify the PE header.

It creates the following directory:

%sysdir%\wsnpoem\ (hidden, system attributes)

%sysdir%\wsnpoem\audio.dll - data file 
%sysdir%\wsnpoem\video.dll - config file 

The Trojan adds itself to the following registry keys:

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
userinit="%sysdir%\ntos.exe"


[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run]
userinit="%sysdir%\ntos.exe"

It modifies:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
Value "Userinit":

from

"%sysdir%\userinit.exe,"

"%sysdir%\userinit.exe,%sysdir%\ntos.exe,"

The Trojan injects itself into winlogon.exe and from there on functions as a handle.

It creates the following mutex:

__SYSTEM__64AD0625__

to flag its presence in the system.

Payload

The Trojan contacts 81.95.148.244 to download its config file, check for updates and to transmit harvested data.

It accesses PStore to retrieve passwords.

It also monitors network activity for the following:

The Trojan captures information submitted via POST by browser to steal login data from sites.

Captured data is transferred via FTP.

Removal instructions

1. Use Kaspersky Anti-Virus 6.0 to delete the Trojan. Update your antivirus databases and perform a full scan of your computer (download a trial version of Kaspersky Anti-Virus).

Summary

• Performs potentially dangerous activity

Technical details

File size of 34304 bytes.

Installation

Makes copies of itself with the following names once launched:

• Windows system directory (usually, C:\Windows\System32) %System%\ntos.exe

Malicious activity

Creates unique identifiers to flag its presence in the system

• __SYSTEM__91C38905__

Other activities

Modifies the system registry keys:

[ System registry hive HKEY_LOCAL_MACHINEHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ] "userinit" = "C"

Description:
­Specifies the file that will be launched when a user enters the system­