high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Protection available since | 29 November 2004 16:23:46 (GMT) |
| Detected by | All Sophos products |
Sophos beta program
- Endpoint Security and Control 9.0
- Small business solutions 4.0
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Banker-FN is a password stealing Trojan aimed at customers of Brazilian banks.
Troj/Banker-FN will monitor a user's internet access. When certain internet banking sites are visited, the Trojan will display a fake login screen in order to trick the user into inputting their details. The following URLS are monitored:
https://www2.bancobrasil.com.br/
http://www.bradesco.com.br
https://www2.realsecureweb.com.br/
https://internetcaixa.caixa.gov.br/
Troj/Banker-FN will then send the stolen details to a Brazilian email address.
Troj/Banker-FN may arrive as a self-extracting archive installer. The installer will drop the Trojan with filename NETXP.EXE into a folder named IE in the Windows folder. In order to run the Trojan automatically each time a user logs in, the installer will set the following registry entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
WinSig
<WINDOWS>\IE\NetXP.exe
|
