Troj/Bancban-KB is a password stealing Trojan targeted at customers of Brazilian banks.
Troj/Bancban-KB includes functionality to access the internet and communicate with a remote server via HTTP.
The Trojan attempts to log keypresses entered into certain websites and online banking applications. The Trojan may display fake user interfaces in order to persuade the user to enter confidential details. Stolen information is sent by email to a remote user.
Troj/Bancban-KB is a password stealing Trojan targeted at customers of Brazilian banks.
Troj/Bancban-KB includes functionality to access the internet and communicate with a remote server via HTTP.
The Trojan attempts to log keypresses entered into certain websites and online banking applications. The Trojan may display fake user interfaces in order to persuade the user to enter confidential details. Stolen information is sent by email to a remote user.
When Troj/Bancban-KB is installed it creates the file <System>\imgrt.txt which is an image file and can be safely deleted.
Troj/Bancban-KB is usually located as the <System>\imgrt.scr file.
The following registry entry is created to run the Trojan on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
dark
<System>\imgrt.scr
Troj/Bancban-KB may create registry entries under the following entry:
HKCU\dark\