TROJ_BANKER.SCR

This malicious .DLL file monitors the address bar of Internet Explorer and checks if the user tries to visit websites with certain strings. If the website contains any of the above-mentioned strings, it connects to any of specific websites to download and execute a malicious file.

This Trojan may be dropped by other malware. It may be downloaded from remote sites by other malware.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Arrival Details

This Trojan may be dropped by other malware.

It may be downloaded from remote site(s) by the following malware:

• TROJ_DLOADR.SCR

Autostart Technique

This Trojan registers itself as a BHO to ensure its automatic execution every time Internet Explorer is used by adding the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{FFADDC14-BA46-4A8A-984A-ADBE1C6D37EA}\InProcServer32
@ = {malware path and file name}.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{FFADDC14-BA46-4A8A-984A-ADBE1C6D37EA}

Download Routine

This Trojan saves the files it downloads using the following names:

• %Windows%\inf\update.exe - detected as TSPY_ZBOT.TOL

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Other Details

This Trojan does the following:

• This malicious .DLL file monitors the address bar of Internet Explorer and checks if the user tries to visit websites with the following strings:
  
  • /EBC_EBC1961
  • /ebc_ebc1961
  • commercial.wachovia.com
  • wc.wachovia.com
  • wcp.wachovia.com
  • chsec.wellsfargo.com
  • wellsoffice.wellsfargo.com
  • ceowt.wellsfargo.com
  • wellsnet.wellsfargo.com
  • treasury.pncbank.com
  • infoplus.mandtbank.com
  • webbankingforbusiness.mandtbank.com
  • gateway.firstbanks.com
  • capitalonebank.com
  • businessonline.huntington.com
  • .53.com
  • singlepoint.usbank.com
  • directline4biz.com/bbwflow1
  • directline4biz.com
  • ctreporter.coletaylor.com
  • thebeneficial-corpbank.com
  • treasurydirect.soc.tdbank.com
  • netconnect.bokf.com
  • e-access.compassbank.com
  • direct.bankofamerica.com
  • businessaccess.citibank.citigroup.com
  • bbvanetcash.com
  • cashproonline.bankofamerica.com
  • treasurypro.umpquabank.com
  • bob.sovereignbank.com
  • citizensbankmoneymanagergps.com
  • citizensbankonline.com
  • netteller.com
  • commercial.bnc.ca
  • intrusttreasury.com
  • salesforce.com
  • cityntl.webcashmgmt.com
  • eastwestbank.webcashmgmt.com
  • ffce.webcashmgmt.com
  • onb.webcashmgmt.com
  • webcashmgmt.com
  • manufacturers.web-access.com
  • mgt.frostbank.com
  • web-access.com
  • secureinternetbank.com/WebCaptureWeb
  • hsbcnet.com
  • scotiabank.com
  • enterprise2.openbank.com
  • tdcommercialbanking
  • tdcecorp.com
  • ucbecorp.com
  • commbank.com.au
  • comerica.com
  • bankwest.com.au
  • nab.com.au
  • treasuryservices
  • banknow.
  • texascapitalbank.com
  • wcb.com
  • tmcb.zionsbank.com
  • secure-eccu.org
  • goldleafach.com
  • bpna.webcashmanager.com
  • huntington.enterprisebanker.com
  • sterlingbank.enterprisebanker.com
  • integrabank.enterprisebanker.com
  • fnfgbusinessonline.enterprisebanker.com
  • republicbank.enterprisebanker.com
  • wcma.businesscenter.ml.com
  • nhsb.wblnk.com
  • otm.suntrust.com
  • businessportal.mibank.com
  • tcfexpressbusiness.com
  • mibusinessonlinebanking.ebanking-services.com
  • peoplesunited.ebanking-services.com
  • firstbusiness.ebanking-services.com
  • citidirect-eb.citicorp.com
  • ktt.key.com
  • ktt4c.key.com
  • kbo.key.com
  • access.jpmorgan.com
  • tssportal.jpmorgan.com
  • srvc2.jpmorgan.com
  • srvc1.jpmorgan.com
  • banquepopulaire.fr
  • credit-agricole.fr
  • onesource.ubs.com
  • onlineserv/CM
  • directnet.com
  • direct.db.com
  • businessbankingcenter.synovus.com
  • cashman.arvest.com
  • secure.fundsxpress.com
  • www.business.barclays.co.uk
  • dzbank.de
  • combnk.com
  • sso.usbib.net.hsbc.com
  • smbc.co.jp
  • auth.carolinetools.com
  • etreasury.carolinetools.com
  • businessnet.bankaustria.at
  • online.bankaustria.at
  • corporateconnect.net
  • e-moneyger.com
  • sso.unionbank.com
  • cmserver
  • /wire
  • cashm
  • treasury
  • direct.bank
  • webcm
  • business
  • /admin/
  • goldleaf
  • wires
  • ebanking-services.com
  • megabank
  • royalbank.com
  • rbc.com
  • rbc.ca
  • businessbank
  • westernunion
  • frostbank
If the website contains any of the above-mentioned strings, this malicious .DLL file connects to any of the following websites to download and execute a malicious file:

• http://www.{BLOCKED}ellphotos.com/images/img_49jfdnmgudfg.jpg
• http://www.{BLOCKED}i.com/img_49jfdnmgudfg.jpg
• http://{BLOCKED}ling.com/img_49jfdnmgudfg.jpg
• http://www.{BLOCKED}osshrco.org/img_49jfdnmgudfg.jpg