Troj/Banker-ADR is a password stealing Trojan for the Windows platform.
Troj/Banker-ADR targets the customers of certain Brazilian online banking websites by displaying fake interfaces, and recording any entered details.
Troj/Banker-ADR may arrive as a self-extracting archive file with the filename system.exe.
When the Trojan is installed the following files are created:
<Windows system folder>\Certificado.exe
<Windows system folder>\svchosts.exe
<Windows folder>\zzzzz<computer name>.txt
where zzzzz<computer name>.txt is a log file and can be safely deleted.
In order to run automatically each time Windows is started, Troj/Banker-ADR will set the following registry entry:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
svchosts
<Windows system folder>\svchosts.exe
Periodically, Troj/Banker-ADR will archive the stolen information and email it to a Brazilian email address.