Threat behavior
WinREG/Banker is a registry import data file used as a tool by
Win32/Banker to delete registry subkeys and registry data that enhance Web browser security for certain online banking Web sites. The presence of this data file may be an indication that the computer is affected by
TrojanSpy:Win32/Banker.
Installation
WinREG/Banker may be installed by variants of TrojanSpy:Win32/Banker.
Payload
Removes registry values and data
Win32/Banker uses WinREG/Banker.A to remove the following registry subkeys and corresponding data:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C41A1C0E-EA6C-11D4-B1B8-444553540000}
HKLM\SYSTEM\CurrentControlSet\Services\GbpSv
HKLM\SYSTEM\ControlSet001\Services\GbpSv
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_GBPSV
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_GBPSV
HKCR\CLSID\{E37CB5F0-51F5-4395-A808-5FA49E399008}
HKCR\CLSID\{E37CB5F0-51F5-4395-A808-5FA49E399003}
HKCR\CLSID\{DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931}
HKCR\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540000}
HKCR\TypeLib\{C41A1C01-EA6C-11D4-B1B8-444553540000}
HKCU\Software\GbPlugin
HKLM\SOFTWARE\Classes\TypeLib\{C41A1C01-EA6C-11D4-B1B8-444553540003}
HKCR\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540003}
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_GBPSV
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ GbPluginBb
HKEY_CLASSES_ROOT\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540000}
HKEY_CLASSES_ROOT\CLSID\{E37CB5F0-51F5-4395-A808-5FA49E399F83}
HKEY_CLASSES_ROOT\Gbieh.GbIehObj
HKEY_CLASSES_ROOT\Gbieh.GbIehObj.1
HKEY_CLASSES_ROOT\Gbieh.GbPluginObj
HKEY_CLASSES_ROOT\Gbieh.GbPluginObj.1
HKEY_CLASSES_ROOT\GbpDist.GbpDistObj
HKEY_CLASSES_ROOT\GbpDist.GbpDistObj.1
HKEY_CLASSES_ROOT\Interface\{C41A1C0D-EA6C-11D4-B1B8-444553540000}
HKEY_CLASSES_ROOT\TypeLib\{C41A1C01-EA6C-11D4-B1B8-444553540000}
HKLM\SOFTWARE\Classes\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540000}
HKLM\SOFTWARE\Classes\CLSID\{E37CB5F0-51F5-4395-A808-5FA49E399F83}
HKLM\SOFTWARE\Classes\Gbieh.GbIehObj
HKLM\SOFTWARE\Classes\Gbieh.GbIehObj.1
HKLM\SOFTWARE\Classes\Gbieh.GbPluginObj
HKLM\SOFTWARE\Classes\Gbieh.GbPluginObj.1
HKLM\SOFTWARE\Classes\GbpDist.GbpDistObj
HKLM\SOFTWARE\Classes\GbpDist.GbpDistObj.1
HKLM\SOFTWARE\Classes\Interface\{C41A1C0D-EA6C-11D4-B1B8-444553540000}
HKLM\SOFTWARE\Classes\TypeLib\{C41A1C01-EA6C-11D4-B1B8-444553540000}
The trojan removes additional values.
Deletes value: "{E37CB5F0-51F5-4395-A808-5FA49E399F83}"
Within subkeys:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
Additional Information
Analysis by Dan Kurc
Prevention