Troj/Bancban-FC is a password stealing Trojan for the Windows platform.
Troj/Bancban-FC targets the customers of certain Brazilian banks by displaying
fake interfaces and logging any details that are entered.
Troj/Bancban-FC includes functionality to send notification messages to remote
locations.
When first run Troj/Bancban-FC copies itself to <Windows>\wupdmgr.exe.
The following registry entry is created to run wupdmgr.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Windows Update
<Windows>\wupdmgr.exe