Internet Security Threats

Trojan-Spy.Win32.Banker.ckj

RISK LEVEL:2

This Trojan intercepts confidential user data. It is a Windows PE EXE file,29KB in size, packed using MEW. The unpacked file is approximately 225KB insize.

Installation

When launched, the Trojan extracts from itself the following file, which is41,472 bytes in size:

%System%\msie.dll

The Trojan also registers this file in the system registry, ensuring thatit will be launched each time Windows is booted on the victim machine:

The Trojan then deletes its executable file and ceases running.

The Trojan component %System%\msie.dll installs hooks for the following APIfunctions:

InternetCrackUrlInternetConnectAHttpOpenRequestAHttpSendRequestAInternetReadFile

The Trojan uses these hooks to track user activity on the following sites:

On these sites, the Trojan will intercept information values entered in fieldswith the following names:

AccountIDStoreMyNumberPassPhraseTuringAmountautoT1autoT2IdPayee_AccountLoginSpendSchmetterling

The Trojan also harvests Microsoft Office account passwords..

The Trojan saves harvested data to the following log files:

%System%\info.dat%System%\ms.dat

These files are periodically uploaded to the remote malicious user’sFTP server.

If your computer does not have an up-to-date antivirus, or does not have anantivirus solution, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the Trojan process.
2. Delete the original Trojan file (its location will depend onhow the program originally penetrated the victim machine).
3. Delete the following files:

   %System%\msie.dll %System%\info.dat %System%\ms.dat

4. Delete the following registry key parameter:

   [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]"AppInit_DLLs" = "%System%\msie.dll"

5. Update your antivirus databases and perform a full scan of thecomputer (download a trial version of Kaspersky Anti-Virus).