TSPY_BANKER.TNK

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It uses a convincing Graphical User Interface to make the users think that the software is legitimate.

It attempts to steal information, such as user names and passwords, used when logging into certain banking or finance-related websites.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Information Theft

Upon execution of the file, the user is presented with the following window:

• img1.bmp {to be emailed after this}

It attempts to steal information from the following banks and/or other financial institutions:

• Banco Itau

Stolen Information

This spyware sends the gathered information via HTTP POST to the following URL:

• http://www.{BLOCKED}ad.se/components/stk.php

Other Details

This spyware did not exhibit propagation routines during testing.

It did not exhibit download routines during testing.

It did not exhibit backdoor routines during testing.

When translated in English, it says:

For your safety, Itau is upgrading your iToken device for version 1.2 for possible failures in synchronization. To continue with the completion of the synchronization, datas are required.
You must be connected to the Internet.

Variant Information

This spyware has the following MD5 hashes:

• 62ab953d239d02ff0a37650529bbd760

It has the following SHA1 hashes:

• 3babe7e75180094cff190b097a4718a34260595f