Internet Security Threats

Trojan-Spy.Win32.Banker.cmp

RISK LEVEL:2

This Trojan program is designed to steal confidential data. It is a WindowsPE EXE file, and is 34304 bytes in size. It is packed using a customized packer.

The Trojan copies itself to

%sysdir%\ntos.exe

with system, read only and archive attributes.

When copying it appends random-sized junk to the end of its file in an attemptto make detection more difficult. It does not modify the PE header.

It creates the following directory:

%sysdir%\wsnpoem\ (hidden, system attributes)%sysdir%\wsnpoem\audio.dll - data file %sysdir%\wsnpoem\video.dll - config file 

The Trojan adds itself to the following registry keys:

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]userinit="%sysdir%\ntos.exe"
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run]userinit="%sysdir%\ntos.exe"

It modifies:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]Value "Userinit":

from

"%sysdir%\userinit.exe,"

"%sysdir%\userinit.exe,%sysdir%\ntos.exe,"

The Trojan injects itself into winlogon.exe and from there on functions asa handle.

It creates the following mutex:

__SYSTEM__64AD0625__

to flag its presence in the system.

The Trojan contacts 81.95.148.244 to download its config file, check for updatesand to transmit harvested data.

It accesses PStore to retrieve passwords.

It also monitors network activity for the following:

The Trojan captures information submitted via POST by browser to steal logindata from sites.

Captured data is transferred via FTP.

1. Use Kaspersky Anti-Virus 6.0 to delete the Trojan. Update yourantivirus databases and perform a full scan of your computer (download a trial version of Kaspersky Anti-Virus).