TROJ_AGENT.AFUF

This Trojan arrives on the system as a file downloaded from a certain URL.

Upon execution, it drops a copy of itself in the system folder. It then appends extra codes at the end of file of the dropped copy to avoid easy detection.

It creates and modifies registry entries to enable its automatic execution at every system startup.

This Trojan connects to a certain Web site to download an encrypted configuration file. The said file contains a list of targeted bank-related Web sites to monitor from which this Trojan steals information.

It steals sensitive information, such as user names and passwords. This routine risks the exposure of sensitive information, which may then lead to the unauthorized use of the stolen data.

Related Items