TrojanSpy:Win32/Banker.SL

TrojanSpy:Win32/Banker.SL is a data-stealing trojan that captures online banking credentials, such as account login names and passwords, then relays the captured information to a remote attacker. Win32/Banker.SL targets customers of certain banks.

Installation

TrojanSpy:Win32/Banker.SL drops the following file:

• <malware file name>.ttp - contains system information

It also creates the following registry entry to ensure that it automatically starts every time Windows starts:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "Winsock"
With data: "<malware file name>"

Payload

Steals sensitive data
TrojanSpy:Win32/Banker.SL monitors visits to websites of the following Brazilian banks to steal online banking credentials, such as account login names and passwords:

• Banco Bradesco
• Santander

The stolen information is then sent to a remote attacker.

Downloads additional files
TrojanSpy:Win32/Banker.SL connects to the following website to download additional files:

• imobiliariacanela.com.br

Analysis by Elda Dimakiling