Trojan-Banker.Win32.Banker.u

Technical Details

This Trojan spy program is designed to steal confidential financial information. It also has a backdoor function.

The Trojan itself is a Windows PE EXE file approximately 10KB in size, packed using UPX. The unpacked file is approximately 75KB in size.

When installing itself to the system, the Trojan creates the following files in the Windows system directory:

lsd_f3.dll
iesprt.sys

lsd_f3.dll
timestamp.sys

Banker.u creates the following entries in the system registry:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\Notify\f3dsl]
 "Dllname"="lsd_f3.dll"
 "Startup"="LSD_F3"
 "Impersonate"="1"
 "Asynchronous"="1"
 "MaxWait"="1"

The Trojan scans all accessible network and Internet resources for links to banking and other financial information and resources, harbests this information and uploads it to an Internet site.

Banker.u has a backdoor function, which provides a malicious remote user with full access to the infected machine, and makes it possible to download files from the Internet and execute them.