CashBank is a Trojan for the Windows platform.
CashBank includes functionality to access the internet and communicate with a remote server via HTTP.
When CashBank is installed the following files are created:
<Windows>\cashn.exe
<Windows>\cashr.dll
<Windows>\delpa.exe
<System>\tlnter.exe
The file tlnter.exe is registered as a new system driver service named "wkststp", with a display name of "Workstation Service" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\wkststp
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mycashbank
CashBank provides an uninstall option which can be accessed via the Add or Remove Programs dialog in the Windows Control Panel. The software is listed as "Mycashbank".