TSPY_BANKER.WYQ

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It uses a convincing Graphical User Interface to make the users think that the software is legitimate.

It attempts to steal information, such as user names and passwords, used when logging into certain banking or finance-related websites.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Information Theft

This spyware attempts to steal information from the following banks and/or other financial institutions:

• Banco Itau

Stolen Information

This spyware sends the gathered information via HTTP POST to the following URL:

• http://www.{BLOCKED}estindustrykings.com/AlyshaSheShe/stk.php

Other Details

This spyware did not exhibit propagation routines during testing.

It did not exhibit download routines during testing.

It did not exhibit backdoor routines during testing.

It does the following:

• Upon execution, this spyware displays the following window:
  

  

  
  When translated in English, it says: "For your safety, Itau is updating its iToken device to version 1.2 for possible imperfections in synchronization. To continue with the synchronization, the following data must be completed." When the user clicks any of the buttons, the window below is displayed:
  

  

  
  The window above, as well as those below ask for the users’ private bank information.
  

  

  

  

Variant Information

This spyware has the following MD5 hashes:

• 6e7ee8cd1df4790befa7ff6f35f4b81c

It has the following SHA1 hashes:

• 8db3e4dd5639a9158c2d465545489d687606bed8