Infostealer.Bancos

Upon execution, the Trojan displays the following message box:
Title: "BOOK COM AMOR"

If the user clicks "Continuar" in the message box, the Trojan creates the following files:

• %System%\Msvbvm60.dll
• %System%\Winmaxy.exe

After dropping the above files, the Trojan then executes itself.

Next, the Trojan creates the following registry entry so that it executes whenever Windows starts:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\"WinMenssage" = "%System%\winmaxy.exe"

The Trojan then searches for the following file:
C:\BancoBrasil\officeIE\officeIE.CAB

If the above file exists, the Trojan moves it to the following location:
C:\officeIE.CAB

The Trojan monitors active Internet Explorer windows. When the user visits a Web site that matches the characteristics of certain Brazilian banking sites, the Trojan displays a login screen for the site. The Trojan may then send the collected information to an FTP site that is predefined by the author.

Summary