Troj/Bancban-MJ attempts to log information sent to certain websites and online banking applications. The Trojan may display fake user interfaces in order to persuade the user to enter confidential details. Stolen information is sent by email to a remote user
Troj/Bancban-MJ may also perform the following functions:
- start a Proxy server
- download and execute additional files
The following registry entry is created to run Troj/Bancban-MJ on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
aaprotect
<path to Trojan>