Home / malwarePDF  

Banker.ARK


First posted on 13 September 2006.
Source: SecurityHome

Aliases :

Banker.ARK is also known as TSPY_BANKER.BVE, TR/Spy.Banker.abn.2, TrojanSpy:Win32/Banker!06E9.

Explanation :

Banker is a family of spying trojans that attempt to steal information that is required to access the websites of certain online banks and online payment systems. Banker trojans usually steal logins, passwords, PINs, check words, and other info related to logging onto financial websites. This variant of Banker attempts to attack some Online Brazilian Bank Account Holders.

This memory resident Trojan-Spy Malware drops a copy of itself in the Windows System folder with filename SYSTEM32.EXE. Moreover, it drops several copies of itself in the following fixed locations and filename depending the operating system:

For Windows 2000 and XP:

  • C:Documents and SettingsAll UsersMenu IniciarProgramasInicializarsystem32.exe

  • C:Documents and SettingsAll Usersstart menuprogramsstartupsystem32.exe


For Windows 98:
  • C:WindowsMenu IniciarIniciarsystem32.exe


It then adds the following registry entry as its auto start technique:
  • [HKEY_LOCAL_MACHINESOFTWARE MicrosoftWindowsCurrentVersionRun]
    "system32" = "%sysdir%system32.exe"


*NOTE %SysDir% is Windows System folder.


Banker steals logon credentials, that are related to some Brazilian Banks, by logging keystrokes when the Internet Browser title bar contains any of the following strings:
CAIXA
caixa
check
http://www.spc.com.br/consulta.php
pay.checkcheck.com.br
PayPal - Welcome
sant
santandernet.com.br
spc.Internet Banking
unib
Unibanco.com

Banker uses the following account details to send the stolen information to
yes@baby.com:
Smtp server : smtp.sao.[REMOVED].com.br
E-mail acccount : bandidodimas@[REMOVED].com.br
Password : f1l1pp3

Information stolen includes the following details:
Bank Name
Computer Name
IE-Version
IP Address
MAC Address
Password
System Date
System Time
Username

Solution :

To manually disinfect standalone malware (backdoors, worms, trojans, etc.) it's usually enough to delete all infected files from a computer and to restart it. Active malware files are usually locked by operating system so different disinfection approaches are required for different operating systems.
Please note that manual disinfection is a risky process, so it is recommended only for advanced users.

If Windows 95, 98 and ME operating system is used, it is recommended to restart a computer from a bootable system diskette and to delete an infected file from command prompt. For example if a malicious file named ABC.EXE is located in Windows folder, it is usually enough to type the following command at command prompt:

DEL C:\WINDOWS\ABC.EXE


and to press Enter. After that an infected file will be gone. If Windows NT, 2000 or XP is used, a malicious file has to be renamed with a different extension (for example .VIR) and then a system has to be restarted. After restart a renamed malicious file will no longer be active and it can be easily deleted manually.

Windows System Restore Issues

If Windows ME or XP is used, it is recommended to disable System Restore feature of these operating systems to prevent a computer from re-infection by an already removed malware. The fact is that System Restore feature of these operating systems might save an infected file into the special folder and copy it back to a hard drive it every time it's been renamed or deleted.

It is recommended to re-enable System Restore after disinfection in order to restore stable system configuration in the future, if any crash or incompatibility issue occurs.

Last update 13 September 2006

 

TOP

Malware :

Family: