TSPY_BANKER.SBQ

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
ms{malware file name} = "{malware path and file name}"

Other System Modifications

This spyware adds the following registry keys:

HKEY_CURRENT_USER\AppEvents\Schemes\
Apps\Explorer\Navigating\
Old_Current

It deletes the following registry keys:

HKEY_CURRENT_USER\AppEvents\Schemes\
Apps\Explorer\Navigating\
.Current

Other Details

This spyware connects to the following possibly malicious URL:

• {BLOCKED}a.com
• sn136w.{BLOCKED}6.mail.live.com/md/c.aspx