Trojan-Banker.Win32.Banker.ae

Technical Details

This Trojan program is designed to steal a range of confidential information. It harvests information entered via the keyboard. It is a Windows PE EXE file. The file is 5,184 bytes in size. It is packed using FSG. The unpacked file is approximately 22KB in size.

Installation

When launched, the Trojan copies its executable file to the Windows root directory under the original file name:

In order to ensure that the Trojan is launched automatically when the system is rebooted, the Trojan registers its executable file in the system registry:

The Trojan also extracts the following DLL file from its body:

It then loads the DLL file.

Payload

When HookerDll.Dll is loaded, mouse and keyboard events will be intercepted. This enables to Trojan to track information entered in windows whose headings contain the following strings:

Information entered via the keyboard is saved to the following file:

and sent to the remote malicious user at the following email address:

The Trojan also performs the following actions:

• launches a stream which will periodically delete the contents of the Windows clipboard
• delete URLs which contain the string "Cookie" from the cache.

Removal instructions

1. Use Task Manager to terminate the Trojan process:
2. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
3. Delete the following files:
   %WinDir%\<original name of Trojan file>
   %WinDir%\HookerDll.Dll
   %WinDir%\krk.txt
4. Delete the following registry value:
   [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
   "OLE"="<path to Trojan executable file>:"
5. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).