Home / malware

PDF

Trojan:Win32/Banload.AJI

First posted on 01 June 2012.
Source: Microsoft

Aliases :

There are no other names known for Trojan:Win32/Banload.AJI.

Explanation :

Trojan:Win32/Banload.AJI is a member of Win32/Banload - a family of trojans that downloads other malware. Banload is usually used to download and install members of the Win32/Banker and Win32/Bancos families onto affected computers. Win32/Banker and Win32/Bancos are trojans that steal banking credentials and other sensitive data, and send it back to a remote attacker. Installation When executed, Trojan:Win32/Banload.AJI copies itself to %windir%\q63qv15rfzrv64.exe. The malware modifies the following registry entries to ensure that its copy executes at each Windows start:

Adds value: "AutoMsnSecurity"
With data: "c:\windows\q63qv15rfzrv64.exe"
To subkey: HKCU\Software\Microsoft\windows\currentversion\run The malware creates the following files on an affected computer:

• %windir%\q63qv15rfzrv64.log
• %windir%\q63qv15rfzrv64.txt

Payload Modifies browser settings Trojan:Win32/Banload.AJI modifies web browser settings on the infected computer by making the following registry modification:

Adds value: "AutoConfigURL"
With data: ""
To subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Contacts remote hostThe malware may contact a remote host at www.cadastramentos.net using port 80. Commonly, malware may contact a remote host for the following purposes:

• To report a new infection to its author
• To receive configuration or other data
• To download and execute arbitrary files (including updates or additional malware)
• To receive instruction from a remote attacker
• To upload data taken from the affected computer

This malware description was produced and published using our automated analysis system's examination of file SHA1 f4a33faab64d9d08f2de940ecbbc8f0fa97e942b.

Last update 01 June 2012

 

TOP