Troj/Bancban-BO is a password stealing Trojan for the Windows platform.
Troj/Bancban-BO copies itself to the Windows system folder as ftpmon.exe and
creates the following registry entry to ensure it is run at system logon:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
irwftp
%SYSTEM%\ftpmon.exe
Troj/Bancban-BO monitors which URLs are visited by the web browser and creates fake web pages for certain Brazilian banking sites in order to log account information. The logged information is sent to remote users via email.