Troj/Bancos-BH is a password-stealing Trojan targeted at certain Brazilian online banking websites.
The Trojan displays fake login screens to a number of Brazilian banks that offer online services in an attempt to steal bank account details.
Troj/Bancos-BH copies itself to the Windows help folder with the filename "unicox.exe" and creates the clean text files "foxdll.vxd" and "first.dll". The clean DLL "crss1.ocx" will also be created.
Troj/Bancos-BH creates the following registry entry in order te be run automatically on computer logon:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
foxhonz5568
<Windows folder>\help\unicox.exe