Win32/Spy.Banker [Threat Name] go to Threat
Win32/Spy.Banker.QEP [Threat Variant Name]
Category | trojan |
Size | 6560566 B |
Aliases | TrojanSpy:Win32/Bancos.DI (Microsoft) |
Infostealer.Bancos (Symantec) | |
TR/Autorun.FR (Avira) |
Short description
Win32/Spy.Banker.QEP is a trojan that steals sensitive information. The trojan attempts to send gathered information to a remote machine. The file is run-time compressed using UPX .
Installation
When executed, the trojan copies itself into the following location:
- %localappdata%\ctfmow.exe
In order to be executed on every system start, the trojan sets the following Registry entry:
- [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
- "(Default)" = "%localappdata%\ctfmow.exe"
The following Registry entries are created:
- [HKEY_CURRENT_USER\EnganarAVG]
- [HKEY_CURRENT_USER\Virusinicializar]
The following Registry entries are set:
- [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
- "EnableBalloonTips" = 0
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
- "EnableLUA" = 0
- [HKEY_CURRENT_USER\Software\Sysinternals\PsKill]
- "EulaAccepted" = 1
- [HKEY_CURRENT_USER\Software\Sysinternals\PsExec]
- "EulaAccepted" = 1
The trojan creates the following files:
- C:\windows\Key_RevoltadoNova
The trojan may create the following files:
- C:\Morre.exe (187184 B)
- C:\System.exe (303616 B)
- C:\Permissao.exe (234536 B)
- C:\registros.reg (8944 B)
- C:\setreg.cmd (527 B)
Information stealing
Win32/Spy.Banker.QEP is a trojan that steals sensitive information.
The trojan collects information used to access certain sites.
The trojan affects the behavior of the following applications:
- Internet Explorer
- Mozilla Firefox
- Google Chrome
The virus searches for windows with the title containing any of the following strings:
- Banco Itaú - Feito Para Você - Google Chrome
- Banco Itaú - Feito Para Você - Microsoft Internet Explorer
- Banco Itaú - Feito Para Você - Mozilla Firefox
- Banco Itaú - Feito Para Você - Windows Internet Explorer
- Bradesco - Google Chrome
- Bradesco - Microsoft Internet Explorer
- Bradesco - Mozilla Firefox
- Bradesco - Windows Internet Explorer
- Bradesco Pessoa Jurídica - Microsoft Internet Explorer
- Bradesco Pessoa Jurídica - Windows Internet Explorer
- Credicard - Google Chrome
- Credicard - Mozilla Firefox
- Entrar - Google Chrome
- Entrar - Microsoft Internet Explorer
- Entrar - Mozilla Firefox
- Entrar - PayPal - Google Chrome
- Entrar - PayPal - Microsoft Internet Explorer
- Entrar - PayPal - Mozilla Firefox
- Entrar - PayPal - Windows Internet Explorer
- Entrar - Windows Internet Explorer
- HSBC Bank Brasil S.A. - Banco Múltiplo - Google Chrome
- HSBC Bank Brasil S.A. - Banco Múltiplo - Mozilla Firefox
- Hotmail
- SICREDI Total Internet - Windows Internet Explorer
- Sicredi Total Internet - Microsoft Internet Explorer
- Sicredi Total Internet - Windows Internet Explorer
- Uniclass - Itaú Uniclass - Google Chrome
- Uniclass - Itaú Uniclass - Internet Explorer
- Uniclass - Itaú Uniclass - Microsoft Internet Explorer
- Uniclass - Itaú Uniclass - Mozilla Firefox
- Uniclass - Itaú Uniclass - Windows Internet Explorer
- [bb.com.br] - Mozilla Firefox
- https://www2.bancobrasil.com.br/aapf/login.jsp?aapf.IDH=sim&perfil=1 - Google Chrome
- https://www2.bancobrasil.com.br/aapf/login.jsp?aapf.IDH=sim&perfil=1 - Microsoft Internet Explorer
- https://www2.bancobrasil.com.br/aapf/login.jsp?aapf.IDH=sim&perfil=1 - Windows Internet Explorer
- internetbankingcaixamicrosoftinternetexplorer
- internetbankingcaixawindowsinternetexplorer
The trojan collects various information when Internet Explorer is being used to access the following sites:
- banrisul.com.br/brb/
- facebook.com/
- http://www.itau.com.br/index.htm
- http://www.santanderempresarial.com.br/
- https://accounts.google.com/ServiceLogin
- https://www.credicard.com.br/BRGCB/JSO/signon/DisplayUsernameSignon.do
- https://www2.bancobrasil.com.br/aapf/login.jsp?aapf.IDH=sim&perfil=1
- https://wwws3.hsbc.com.br/ITE/common/html/hsbc-online.shtml
- itau.com.br/itaucard/
- serasaexperian.com.br
- sicreditotal.com.br
The trojan displays the following fake dialog boxes:
The goal of the malware is to persuade the user to fill in personal information.
The trojan collects the following information:
- login user names for certain applications/services
- login passwords for certain applications/services
- computer name
- volume serial number
- network adapter information
The collected information is stored in the following file:
- c:\%computername%.txt
The trojan attempts to send gathered information to a remote machine.
The trojan contains a list of (7) addresses. The HTTP, FTP protocol is used.
Other information
The trojan executes the following commands:
- cmd /k del "C:\Arquivos de programas\GbPlugin\." /q
- cmd /k rd "%ProgramFiles%\GbPlugin"
- cmd /k del "C:\Program Files (x86)\GbPlugin\." /q
- cmd /k rd "C:\Program Files (x86)\GbPlugin"
The trojan may execute the following commands:
- net.exe stop sharedaccess
- netsh advfirewall set currentprofile state off
- cmd /k regedit /s c:\registros.reg
- cmd /k taskkill -f /im GbpSv.exe /im explorer.exe
- cmd /k c:\Permissao.exe -i -s c:\setreg.cmd
- cmd /k c:\Morre.exe -t winlogon.exe
The trojan may delete the following files:
- C:\Arquivos de programas\GbPlugin\gbiehcef.dll
- C:\Program Files (x86)\GbPlugin\gbiehcef.dll
- C:\Arquivos de programas\GbPlugin\gbieh.dll
- C:\Program Files (x86)\GbPlugin\gbieh.dll
- C:\Arquivos de programas\GbPlugin\gbiehabn.dll
- C:\Program Files (x86)\GbPlugin\gbiehabn.dll
- C:\Arquivos de programas\GbPlugin\gbiehuni.dll
- C:\Program Files (x86)\GbPlugin\gbiehuni.dll
- C:\Arquivos de programas\Scpad\scpsssh2.dll
- C:\Program Files (x86)\Scpad\scpsssh2.dll
- C:\Arquivos de programas\GbPlugin\gbiehscd.dll
- C:\Program Files (x86)\GbPlugin\gbiehscd.dll
- C:\registros.reg
- C:\setreg.cmd
- C:\Morre.exe
- C:\Permissao.exe
- C:\System.exe
The trojan may delete the following Registry entries:
- [HKEY_CLASSES_ROOT\CLSID\{2E3C3651-B19C-4DD9-A979-901EC3E930AF}]
- [HKEY_CLASSES_ROOT\CLSID\{3F888695-9B41-4B29-9F44-6B560E464A16}]
- [HKEY_CLASSES_ROOT\CLSID\{AF45043F-819C-47CC-9B37-94DBE50A6E63}]
- [HKEY_CLASSES_ROOT\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540000}]
- [HKEY_CLASSES_ROOT\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540003}]
- [HKEY_CLASSES_ROOT\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540007}]
- [HKEY_CLASSES_ROOT\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540008}]
- [HKEY_CLASSES_ROOT\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540011}]
- [HKEY_CLASSES_ROOT\CLSID\{DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931}]
- [HKEY_CLASSES_ROOT\CLSID\{E37CB5F0-51F5-4395-A808-5FA49E399003}]
- [HKEY_CLASSES_ROOT\CLSID\{E37CB5F0-51F5-4395-A808-5FA49E399007}]
- [HKEY_CLASSES_ROOT\CLSID\{E37CB5F0-51F5-4395-A808-5FA49E399008}]
- [HKEY_CLASSES_ROOT\CLSID\{E37CB5F0-51F5-4395-A808-5FA49E399011}]
- [HKEY_CLASSES_ROOT\CLSID\{E37CB5F0-51F5-4395-A808-5FA49E399F83}]
- [HKEY_CLASSES_ROOT\Gbieh.GbIehObj.1]
- [HKEY_CLASSES_ROOT\Gbieh.GbIehObj]
- [HKEY_CLASSES_ROOT\Gbieh.GbPluginObj.1]
- [HKEY_CLASSES_ROOT\Gbieh.GbPluginObj]
- [HKEY_CLASSES_ROOT\GbpDist.GbpDistObj.1]
- [HKEY_CLASSES_ROOT\GbpDist.GbpDistObj]
- [HKEY_CLASSES_ROOT\Interface\{7827CCC3-0DEB-4CFB-911C-AA777C8826EA}]
- [HKEY_CLASSES_ROOT\Interface\{C41A1C0D-EA6C-11D4-B1B8-444553540000}]
- [HKEY_CLASSES_ROOT\TypeLib\{04978612-A774-406D-AF1B-F44E2838D72A}]
- [HKEY_CLASSES_ROOT\TypeLib\{6B71634C-5867-4D85-BFFE-DF1C322F8B96}]
- [HKEY_CLASSES_ROOT\TypeLib\{9CA261C7-D518-4987-B434-10A1B243C8B8}]
- [HKEY_CLASSES_ROOT\TypeLib\{AD764BE6-87A7-46A1-8C55-A712D079E749}]
- [HKEY_CLASSES_ROOT\TypeLib\{C41A1C01-EA6C-11D4-B1B8-444553540000}]
- [HKEY_CLASSES_ROOT\TypeLib\{C41A1C01-EA6C-11D4-B1B8-444553540003}]
- [HKEY_CLASSES_ROOT\TypeLib\{C41A1C01-EA6C-11D4-B1B8-444553540007}]
- [HKEY_CLASSES_ROOT\TypeLib\{C41A1C01-EA6C-11D4-B1B8-444553540008}]
- [HKEY_CLASSES_ROOT\TypeLib\{C41A1C01-EA6C-11D4-B1B8-444553540011}]
- [HKEY_CURRENT_CONFIG\System\CurrentControlSet\Enum\ROOT\LEGACY_GBPSV]
- [HKEY_CURRENT_USER\Software\GbPlugin]
- [HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2E3C3651-B19C-4DD9-A979-901EC3E930AF}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3F888695-9B41-4B29-9F44-6B560E464A16}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3717295-941D-416F-9384-ED1736729F1C}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AF45043F-819C-47CC-9B37-94DBE50A6E63}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540000}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540003}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540007}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540008}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540011}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E37CB5F0-51F5-4395-A808-5FA49E399003}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E37CB5F0-51F5-4395-A808-5FA49E399007}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E37CB5F0-51F5-4395-A808-5FA49E399008}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E37CB5F0-51F5-4395-A808-5FA49E399011}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E37CB5F0-51F5-4395-A808-5FA49E399F83}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Gbieh.GbIehObj.1]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Gbieh.GbIehObj]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Gbieh.GbPluginObj.1]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Gbieh.GbPluginObj]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GbpDist.GbpDistObj.1]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GbpDist.GbpDistObj]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7827CCC3-0DEB-4CFB-911C-AA777C8826EA}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C41A1C0D-EA6C-11D4-B1B8-444553540000}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{04978612-A774-406D-AF1B-F44E2838D72A}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6B71634C-5867-4D85-BFFE-DF1C322F8B96}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{9CA261C7-D518-4987-B434-10A1B243C8B8}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{AD764BE6-87A7-46A1-8C55-A712D079E749}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C41A1C01-EA6C-11D4-B1B8-444553540000}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C41A1C01-EA6C-11D4-B1B8-444553540003}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C41A1C01-EA6C-11D4-B1B8-444553540007}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C41A1C01-EA6C-11D4-B1B8-444553540008}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C41A1C01-EA6C-11D4-B1B8-444553540011}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\GbPluginAbn]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\GbPluginBb]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\GbPluginCef]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\GbPluginScd]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\GbPluginUni]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\GbPluginBb]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\GbPluginCef]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C41A1C0E-EA6C-11D4-B1B8-444553540000}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{E37CB5F0-51F5-4395-A808-5FA49E399F83}]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\WINDOWS\system32\scpLIB.dll]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\WINDOWS\system32\scpMIB.dll]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\WINDOWS\system32\scpsssh2.dll]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{E37CB5F0-51F5-4395-A808-5FA49E399F83}]
- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_GBPKM]
- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_GBPSV]
- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001\System\CurrentControlSet\Enum\ROOT\LEGACY_GBPSV]
- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\Current\System\CurrentControlSet\Enum\ROOT\LEGACY_GBPSV]
- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GbpKm]
- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GbpSv]
- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_GBPSV]
- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Hardware Profiles\0001\System\CurrentControlSet\Enum\ROOT\LEGACY_GBPSV]
- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\GbpKm]
- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\GbpSv]
- [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_GBPKM]
- [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_GBPSV]
- [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\0001\System\CurrentControlSet\Enum\ROOT\LEGACY_GBPSV]
- [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\Current\System\CurrentControlSet\Enum\ROOT\LEGACY_GBPSV]
- [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\GbpKm]
- [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\GbpSv]
- [HKEY_USERS\S-1-5-21-854245398-1708537768-2147221027-1003\Software\GbPlugin]
The trojan may perform operating system restart.