This Trojan arrives on a system as a file dropped by other malware or as a downloaded file from http://{BLOCKED}v.ru/test/ldr.exe.

It downloads an encrypted configuration file from http://{BLOCKED}v.ru/test/cfg.bin. Once decrypted, the downloaded configuration file contains a list of financial-related Web sites which this Trojan monitors. Note that the contents of the file, hence the list of Web sites to monitor, may change any time.

This Trojan attempts to steal sensitive online banking information. When a user attempts to access any of the monitored sites in the configuration file, it captures user input, specifically those entered in the input boxes designed for user names and passwords. This routine risks the exposure of the user's account information, which may then lead to the unauthorized use of the stolen data.

The gathered information is then sent to http://{BLOCKED}v.ru/test/s.php via HTTP POST.

This Trojan terminates itself once firewall-related processes are running in the system.



More...