Troj/Banker-CX is a password-stealing Trojan for the Windows platform.
When first run Troj/Banker-CX copies itself to the Windows system folder and creates the following files:
<Windows system folder>\drivers\root\system\ftp.dll
<Windows system folder>\drivers\root\system\install.dll
<Windows system folder>\drivers\root\system\versao.dll
The following registry entry is created to run Troj/Banker-CX on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
NSystem
<original pathname of the Trojan executable>
Troj/Banker-CX displays fake interfaces for certain Brazilian banking websites in order to steal login details. Any details stolen in this manner are uploaded to an FTP server. The hostname, account name and password for this FTP account are specified in a configuration file downloaded from a preconfigured URL.