TrojanDownloader:Win32/Banload.DJ

TrojanDownloader:Win32/Banload.DJ is a 416,768-byte program written in Delphi that attempts to steal sensitive information. It appears to target Brazilian users.

Once executed the trojan copies itself to <system folder>\bsyys.scr and <startup folder>\bsyys.scr. It also modifies the registry to ensure that it is executed at each Windows start:

 

Adds value: "SymantecFilterCheck"
With data: "<system folder>\bsyys.scr"

To subkey: HKLM\SOFTWARE\Micfrosoft\Windows\CurrentVersion\Run

Notes:
- <system folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP and Vista is C:\Windows\System32.

- <startup folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the Startup folder for Windows 9x, Me, NT, 2000, XP and 2003 is '%USERPROFILE%\Start Menu\Programs\Startup'. For Windows Vista, the default location is '%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'.

The trojan proceeds to monitor window names for the strings "- Convers" and "- Celular" hoping to intercept instant messenger conversations. If a match is found, the trojan attempts to insert the following Portuguese text:

 

 

 

At the time of writing the page referred to in the URL above has been removed and is being treated as a possible phishing attempt.