Email Spam leads to Banking Trojan

July 21, 2011

Sonicwall UTM research team received reports of a new online banking Trojan seen in the wild. This Trojan steals security credentials used to manage various online banking accounts targeting South American Bank Caixa Group.

Users will receive an email similar to the screenshot below related to banking transaction. The email contains a link purportedly to be the proof or receipt of the transaction but otherwise leads to downloading of the banking trojan.


    Translated to English:

    Portuguese - detected to English translation

    Please be advised that scheduling was made in Internal Transfer
    BPI service online, with the following data:

    Schedule Date - 07/18/2011 06:16
    Operation Type - Issuance of checks on foreign
    Nr Documento2342576678899 (9.12 kb)

The email link leads to a compromised website which serves the trojan: http://cla{REMOVED}ua/.../bpi23045.asp

Once the user clicks on the link, it will display the message below showing that the Adobe Reader is outdated and redirects it to the download page.


The Adobe Reader download page is fake and will actually serve the banking trojan.



In order to disguise the banking trojan as a legitimate installer, it uses Adobe Flash icon shown below:

After installation, the trojan will launch these pages to let the user think that it installed a legitimate Adobe Reader and will ultimately show the online banking transaction.



Installed files:

  • %systemdir%1kl1.exe [ detected as GAV: VBKrypt.CQZR (Trojan) ]
  • %systemdir%xservicex.exe [ detected as GAV: VBKrypt.CQZR (Trojan) ]
  • %temp%header_10.1.45.2.exe [ detected as GAV: VBKrypt.CQZR (Trojan) ]

Added Registry:

  • Key: HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
    Value: xservicex

Network Activity:

HTTP Requests:

  • http://www.d{REMOVED}tyjytj/.../c.php
  • http://sch{REMOVED}/willkohead.png

SonicWALL Gateway AntiVirus provided proactive protection against this threat via the following existing signatures:

  • GAV: VBKrypt.CQZR (Trojan)
  • GAV: Banker.UTV (Trojan)