Effects
Banker.LLN is a Trojan designed to steal users' access data to a certain banking entity from Peru. In order to do so, it carries out the following process:
- When users try to access the website belonging to a certain banking entity from Peru, they are redirected to another website that imitates the original one:
- If users enter their banking details in this fake website, they will be harvested by the Trojan and sent to its creator.
Infection strategy
Banker.LLN creates the following files in the folders win\zmwsc, created by itself, of the Windows system directory:
Banker.LLN modifies the HOSTS file. By modifying this file, it redirects the users who visit the website of certain banking entity from Peru to another one that imitate the original one.
Means of transmission
Banker.LLN reaches the computer in a file with the name BARACKOBAMA.EXE and the icon of the United States flag:
However, Banker.LLN does not spread automatically using its own means. It needs an attacking user's intervention in order to reach the affected computer. The means of transmission used include, among others, floppy disks, CD-ROMs, email messages with attached files, Internet downloads, FTP, IRC channels, peer-to-peer (P2P) file sharing networks, etc.
Further Details
Banker.LLN is 490,475 bytes in size.
>>