Troj/Banker-HS is a password-stealing Trojan that targets users of Brazilian banking websites.
Troj/Banker-HS attempts to log keypresses entered into specific websites. The Trojan may display fake user interfaces in order to pursuade the user to enter confidential details such as account number, login name, password and PIN. Stolen information is sent by email to a remote user.
Troj/Banker-HS comprises of the installer and main executable components.
When Troj/Banker-HS is installed the following files are created:
<Temp>\ci0-temp\Ferdg.set
<Temp>\gert0.dll
<Windows>\ie\winB_.exe
where gert0.dll is a part of the installer, winB_.exe is the main executable and Ferdg.set is a customized setup script that is not malicious on its own and may safely be deleted.
The following registry entry is created to run winB_.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
getwin
<Windows>\IE\winB_.exe