Troj/Bancban-EC is an information stealing Trojan for the Windows platform.
Troj/Bancban-EC includes functionality to send notification messages to remote locations.
Troj/Bancban-EC targets the customers of certain Brazilian internet banking websites, attempting to steal account details.
When first run Troj/Bancban-EC copies itself to <System>\20050726-007-i32-1.exe.
The following registry entry is created to run 20050726-007-i32-1.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
20050726-007-i32-1
<System>\20050726-007-i32-1.exe
Troj/Bancban-EC attempts to terminate the following security related processes:
ashwebsv.exe
ashdisp.exe
ashmaisv.exe
ashserv.exe
aswupdsv.exe
avgagent.exe
avgamsvr.exe
avgtcpsv.exe
avgupsvc.exe
avgw.exe
avgcc.exe
avgemc.exe
navapw32.exe
navapsvc.exe
navstub.exe
navw32.exe
savscan.exe
ccapp.exe
ccevtmgr.exe
nmain.exe
symwsc.exe
djsactiv.exe
mcshield.exe
cpd.exe
mcagent.exe
stinger.exe