Description
Win32.Banker.B is a trojan that appears to have been intended by its author to steal confidential financial information and send it to the trojan's controller. In our laboratory tests, this failed to function. It also contains limited backdoor functionality and can download and execute arbitrary files.
Back to top
Method of Infection
This trojan originally consists of an executable that drops a DLL and a driver file (the driver is used to hide running processes as instructed by the DLL).This trojan is similar in function to Win32.A311.
The executable file uses an installer icon.
When run, the main executable creates the following files in the %System% directory:
lds_f3.dll
iesprt.sys
The creation date of these files is set to match the date of the system file, KERNEL32.DLL to help mask their recent creation.
It then creates the following registry values:
HKLM\System\CurrentControlSet\Control\MPRServices\TestService\Dllname="lsd_f3.dll"
HKLM\System\CurrentControlSet\Control\MPRServices\TestService\EntryPoint="LSD_F3"
HKLM\System\CurrentControlSet\Control\MPRServices\TestService\StackSize=0
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\f3dsl\DllName="lsd_f3.dll"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\f3dsl\Startup="LSD_F3"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\f3dsl\Impersonate=1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\f3dsl\Asynchronous=1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\f3dsl\MaxWait=1
After the DLL is installed, the trojan activates the DLL by launching the system application "MPREXE.EXE"; described as "WIN32 Network Interface Service Process". This application comes with Windows 9x installations. As MPREXE.EXE is loaded automatically when Windows starts, the trojan is also executed.
Note: Because of the need for 'MPREXE.EXE', the trojan will not function on Windows NT based machines (this includes XP and 2000). It also causes major system errors in Windows XP, causing it to continually restart. This is presumably a consequence of the way in which the driver attempts to hide processes.
The trojan also creates the atom LOH to ensure that only one copy of the trojan is running at any time on an affected machine.
Back to top
Payload
Keylogging (Intended)
The DLL is intended to scan the Title bar of open windows for any mention of banks or money, and then log any information contained in the window. It then contacts a site with the information obtained and an authorisation string. However, in our laboratory tests this failed to function.
Limited Backdoor Functionality
The DLL can also be instructed to download and execute files.
Back to top
For additional information:
Banker.B creates the following value in the registry for its own use:
HKLM\System\CurrentControlSet\Control\Impersonate = [<Random Numer>[UsernameOfCurrentUser]
Analysis by Matthew McCormack
Back to top