Trojan-Banker.Win32.Banbra

1. What is the Trojan-Banker.Win32.Banbra

Trojan-Banker.Win32.Banbra is a malicious Trojan designed to steal banking details. Trojan-Banker.Win32.Banbra uses stealth tactics to enter the PC before downloading other harmful files from the Internet. Trojan-Banker.Win32.Banbra steals financial data like credit card numbers and online banking login details by taking screen snapshots of user activity. Trojan-Banker.Win32.Banbra also downloads additional components and poses a severe security risk to computer safety.

a. File System Modifications

         %AppData%\36383.js

         %AppData%\hotfix.exe [file and pathname of the sample #1]

         %AppData%\srsf.bat 

Notes:

%AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

.

b. Memory Modifications

       There were new processes created in the system:

c. Registry Modifications

•  The following Registry Key was created:
  o HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
  
   
• The newly created Registry Values are:
  o [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
  + WarnOnPost = 0x00000000
  + WarnOnZoneCrossing = 0x00000000
  + WarnOnPostRedirect = 0x00000000
  + WarnonBadCertRecving = 0x00000000
  o [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  + Shell = "%AppData%\hotfix.exe"
  
  so that hotfix.exe runs every time Windows starts
  
   
•  The following Registry Value was deleted:
  o [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
  + WarnOnPost = 01 00 00 00
   

d. Other details

• The following port was open in the system:

• There was registered attempt to establish connection with the remote host. The connection details are:

• The data identified by the following URL was then requested from the remote web server:

  • http://85.234.191.174/zz.php?id=t_a_d_01

2. How-to's

a. Please update the policy basic knowledge of Sax2  in time, Once  sax2 detects  the communication of these trojans, it will break them and  ensure your network & business security.

b. How to Remove the Trojan-Banker.Win32.Banbra  Manually?

Step 1 : The associated files of Trojan-Banker.Win32.Banbra.ukb to be deleted are listed below:
%ProgramFiles%\Bulk Image Downloader\locale\zh_CHT\LC_MESSAGES
%ProgramFiles%\Bulk Image Downloader\locale\zh_CHT
%ProgramFiles%\Bulk Image Downloader\locale\zh_CHS\LC_MESSAGES
%ProgramFiles%\Bulk Image Downloader\locale\zh_CHS
%ProgramFiles%\Bulk Image Downloader\locale\uk\LC_MESSAGES
%ProgramFiles%\Bulk Image Downloader\locale\uk
%ProgramFiles%\Bulk Image Downloader\locale\tr\LC_MESSAGES
%ProgramFiles%\Bulk Image Downloader\locale\tr
%ProgramFiles%\Bulk Image Downloader\locale\sv\LC_MESSAGES
%ProgramFiles%\Bulk Image Downloader\locale\sv
%ProgramFiles%\Bulk Image Downloader\locale\sr\lc_messages
%ProgramFiles%\Bulk Image Downloader\locale\sr
%ProgramFiles%\Bulk Image Downloader\locale\sk\LC_MESSAGES
%ProgramFiles%\Bulk Image Downloader\locale\sk

Step 2 : The registry entries of Trojan-Banker.Win32.Banbra.ukb that need to be removed are listed as follows:
HKEY_CURRENT_USER\Software\Javasoft\Ex
HKEY_CURRENT_USER\Software\Javasoft
HKEY_CURRENT_USER\Software\Antibody Software\Bulk Image Downloader
HKEY_CURRENT_USER\Software\Antibody Software
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Open current page with BID Link E&xplorer
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Open current page with BI&D
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Open &link target with BID
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Enqueue link tar&get with BID
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\En&queue current page with BID
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt
HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating\Old_Current
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Bulk Image Downloader_is1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BulkImageDownloaderQueue\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BulkImageDownloaderQueue\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BulkImageDownloaderQueue\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BulkImageDownloaderQueue\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BulkImageDownloaderQueue
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BulkImageDownloader\shell\open\command

c. How to Remove these trojans Instantly?

Malwarebytes' Anti-Malware is an anti-malware application that can thoroughly remove even the most advanced malware. It includes a number of features, including a built in protection monitor that blocks malicious processes before they even start. visit http://www.ids-sax2.com/Malwarebytes-Anti-Malware.htm and download Malwarebytes' Anti-Malware to help you.

3. Appendix

For more information, please visit  http://www.ids-sax2.com/ComputerSecurityNewsletter.htm