Troj/Bancos-AO will attempt to copy itself as SVCHOST32.EXE to the "Arquivos de programas" folder in the C: drive. The Trojan will also attempt to copy itself to the C: drive with a filename of WINKERNEL32.EXE. In order to run automatically each time a user logs on, Troj/Bancos-AO sets the following registry entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
SVCHOST32
C:\Arquivos de programas\svchost32.EXE