TROJ_BANKER.FSF
Windows 2000, Windows XP, Windows Server 2003
![](/vinfo/imgFiles/legend.jpg)
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It may be downloaded by other malware/grayware/spyware from remote sites. It may be unknowingly downloaded by a user while visiting malicious websites.
It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.
TECHNICAL DETAILS
Arrival Details
This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.
It may be downloaded by other malware/grayware/spyware from remote sites.
It may be unknowingly downloaded by a user while visiting malicious websites.
Installation
This Trojan drops the following non-malicious files:
- %Windows%\c4.log
(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)
Download Routine
This Trojan connects to the following URL(s) to download its component file(s):
- http://www.{BLOCKED}d.com/file/wlENBzKw/mccatra174.html
It saves the files it downloads using the following names:
- %Windows%\{numbers}.exe
- %Windows%\netcontrol.dll
- %Windows%\pws09.exe
(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)
It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.