Troj/Banker-FN is a password stealing Trojan aimed at customers of Brazilian banks.
Troj/Banker-FN will monitor a user's internet access. When certain internet banking sites are visited, the Trojan will display a fake login screen in order to trick the user into inputting their details. The following URLS are monitored:
https://www2.bancobrasil.com.br/
http://www.bradesco.com.br
https://www2.realsecureweb.com.br/
https://internetcaixa.caixa.gov.br/
Troj/Banker-FN will then send the stolen details to a Brazilian email address.
Troj/Banker-FN may arrive as a self-extracting archive installer. The installer will drop the Trojan with filename NETXP.EXE into a folder named IE in the Windows folder. In order to run the Trojan automatically each time a user logs in, the installer will set the following registry entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
WinSig
<WINDOWS>\IE\NetXP.exe