Home Malware Programs Trojans Infostealer.Banker.E

Infostealer.Banker.E

Posted: August 30, 2011

Infostealer.Banker.E is a banking Trojan infection that steals personal information, specifically banking and user account details from the infected computer. When Infostealer.Banker.E is installed, it creates its startup registry entry to run each time you start your PC. Infostealer.Banker.E also drops malicious files and creates registry entries to harm a computer system. Infostealer.Banker.E may create files to collect the stolen data and to exchange commands with the remote server. Infostealer.Banker.E also has backdoor capabilities and contacts a remote host on TCP port 80. Infostealer.Banker.E receives commands from the remote attacker and can execute numerous malicious actions. You should remove Infostealer.Banker.E as quickly as possible to protect your PC.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%System%\tns1.dll File name: %System%\tns1.dll
File type: Dynamic link library
Mime Type: unknown/dll
%System%\conf.dat File name: %System%\conf.dat
File type: Data file
Mime Type: unknown/dat
%System%\conf1.dat File name: %System%\conf1.dat
File type: Data file
Mime Type: unknown/dat
%System%\cookie1.dat File name: %System%\cookie1.dat
File type: Data file
Mime Type: unknown/dat
%System%\rc.dat File name: %System%\rc.dat
File type: Data file
Mime Type: unknown/dat
%System%\ps1.dat File name: %System%\ps1.dat
File type: Data file
Mime Type: unknown/dat
%System%\te.dat File name: %System%\te.dat
File type: Data file
Mime Type: unknown/dat
%System%\bb1.dat File name: %System%\bb1.dat
File type: Data file
Mime Type: unknown/dat
%System%\cs.dat File name: %System%\cs.dat
File type: Data file
Mime Type: unknown/dat
%System%\boa1.dat File name: %System%\boa1.dat
File type: Data file
Mime Type: unknown/dat
%System%\cmds.txt File name: %System%\cmds.txt
Mime Type: unknown/txt
%System%\alog.txt File name: %System%\alog.txt
Mime Type: unknown/txt
%System%\di1.gif File name: %System%\di1.gif
Mime Type: unknown/gif
%System%\dr1.gif File name: %System%\dr1.gif
Mime Type: unknown/gif

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{CLSID Path}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLISD\{775B738B-4540-4b16-A1DA-932C402FD8F7}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{775B738B-4540-4b16-A1DA-932C402FD8F7}HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\MRSoftHKEY_LOCAL_MACHINE\SOFTWARE\MRSoft\"1" = "[ENCRYPTED CHARACTERS]"HKEY_LOCAL_MACHINE\SOFTWARE\MRSoft\"P" = "[HEX VALUES]"
Loading...