x
48h OFFER
If you're already a customer of
our homeusers protection,
renew now with a 50% off
RENEW NOW
x
SPECIAL OFFER
If you're already a customer of
our homeusers protection,
renew now with a 50% off
RENEW NOW
x
HALLOWEEN OFFER
take advantage of our
terrific discounts
BUY NOW AND GET A 50% OFF
x
CHRISTMAS OFFER
Buy the best antivirus
at the best price
BUY NOW AND GET A 40% OFF
x
SPECIAL OFFER
Buy the best antivirus
at the best price
BUY NOW AND GET A 50% OFF
x
BLACKFRIDAY OFFER
Buy the best antivirus
at the best price
TODAY ONLY UP TO 70% OFF
x
CYBERMONDAY OFFER
Buy the best antivirus
at the best price
(Only for homeusers)
TODAY ONLY UP TO 70% OFF
Active Scan. Scan your PC free
Panda Protection

Virus Encyclopedia

Welcome to the Virus Encyclopedia of Panda Security.

Banker.LYI

Threat LevelLow threatDamageHighDistributionNot widespread
Common name:Banker.LYI
Technical name:Trj/Banker.LYI
Threat level:Medium
Type:Trojan
Effects:  

It is designed to steal users' banking details belonging to a certain banking entity. It reaches the computer in an email message supposedly sent by the police department and which contains an attached file passing itself off as a pdf document.

Affected platforms:

Windows 2003/XP/2000/NT

First detected on:Oct. 1, 2009
Detection updated on:Oct. 2, 2009
StatisticsNo
Proactive protection:
Yes, using TruPrevent Technologies

Brief Description 

    

Banker.LYI is a Trojan designed to steal users' banking details belonging to a certain banking entity.

When it is run, it connects to the official website of the police in order to distract users' attention.

Banker.LYI reaches the computer in an email message that seems to have been sent from the police department and which contains an attached file passing itself off as a pdf document.

Visible Symptoms 

    

Banker.LYI is easy to recognize, as it reaches the computer in an email message written in Spanish which seems to have been sent by the police department and has the following characteristics:

  • Subject: Convocatoria en la Audiencia
  • Message:
    PROCEDIMIENTO DE INVESTIGACIN N 363134/2009
    CONVOCATORIA DE ASISTENCIA EN LA AUDIENCIA del investigador procedimiento anterior, en relacin con la ltima noche de agosto 12 de 2009 se llev a cabo en el delito pblico, como se puede ver el orden que se adjunta.
    Anexo: CONVOCA10-PDF (498k)
    Direccin General de la Polica y de la Guardia Civil | www.policia.es
  • Attachment: a file which passess itself off as a pdf file. However, it has an SCR extension.

When the attached file is run, the following site is opened, which belongs to a certain section of the official website of the police:
http://www.policia.es/cuer_cancela.htm?reload_coolmenus