Trojan.JS.BANKER.THBAIAI

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be dropped by other malware.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be dropped by the following malware:

• Trojan.BAT.BANLOAD.THBAIAI
• TrojanSpy.Win32.BANRAP.AS

Stolen Information

This Trojan Spy sends the gathered information via HTTP POST to the following URL:

• https://{BLOCKED}coesmdsgovbr.org/javascript/log3.php?logins=1

Other Details

This Trojan Spy does the following:

• This malware looks for the following strings first before its executing malicious routine:
  • fetuar
  • agar
  • agamento
  • "sign
  • ontinu
  • inaliza
  • cessa
  • confirma
  • ok
  • ntra
  • avan
  • ogin
  • uber
  • Avan
  • esquisa
  • earch
  • usca
  • clkLgn
  • submit
  • Continuar
  • Finalizar
  • btn btn --arrrow btn-full
  • bv
  • youtube
  • XXXXXXXXXXXX
• It replace the < button tags with < button id="idbtn1".
• It wont continue to its malicious routine if found the following strings:
  • digo de seguran
  • digo de Seguran
  • cvv
• It monitors all visited websites and gathers the following information:
  • location.hostname
  • location.href
  • HTML input elements with the ff. types:
    • password
    • text
    • email
    • tel
    • number
    • hidden
• It also triggers its malicious routine when following buttons are clicked:
  • "#idSIButton9"
  • "#signIn"
  • "#login-signin"
  • "#idbtn1"
• It won't continue to its malicious routine if developers tools/ debugger is open in the browser.