{
  "family": "banks",
  "sample_count": 1,
  "category": "trojan",
  "description": "Trojan:Win32/Banks (often seen as Banker or Bancos) is a generic classification for 'Banking Trojans'. These are highly specialized InfoStealers explicitly designed to compromise online banking sessions, intercept credentials, bypass Two-Factor Authentication (2FA), and initiate unauthorized financial transactions (`T1056.004`). While families like Emotet or Trickbot are specific banking trojans, 'Banks' is used when the exact family cannot be identified, but the behavioral intent is clear.<br><br><b>Understanding Banks (Banking Trojans)</b><br>To an end-user, the infection is completely silent. They log into their bank as usual, unaware that the trojan is modifying the webpage in real-time. For a financial institution or a corporate security team, a Banking Trojan infection represents an immediate risk of direct financial theft and wire fraud.<br><br><b>Execution and 'Web Inject' Mechanics</b><br>Banking Trojans utilize a technique called 'Web Injects' (`T1185`). When they infect a machine, they monitor browser activity (`T1176`). When the user navigates to a targeted banking URL, the trojan intercepts the traffic and injects malicious HTML/JavaScript directly into the displayed page. This allows the trojan to present fake login fields (to steal credentials) or fake 'Security Verification' prompts (to trick the user into entering their SMS 2FA code), all while the browser shows the legitimate bank URL.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is direct financial loss. Host-based IoCs include the presence of malicious browser extensions, unauthorized modifications to the local `hosts` file (`T1556.001`), or EDR alerts for process injection into browser executables (Chrome, Edge). Network IoCs involve the trojan communicating with its C2 server to download the latest configuration file (the 'Web Inject' list) detailing which banks to target.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1556.001",
    "T1185",
    "T1056.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1056.004",
      "name": "Input Capture: Credential API Hooking (Intercepting keystrokes and credentials within the browser)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1185",
      "name": "Browser Session Hijacking (Utilizing Web Injects to modify banking sites in real-time)",
      "tactic": "Collection"
    },
    {
      "id": "T1556.001",
      "name": "Modify Authentication Process: Network Device Authentication (Bypassing 2FA mechanisms)",
      "tactic": "Credential Access"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately; the trojan may be actively initiating wire transfers in the background.",
    "Instruct the user to immediately contact their financial institutions (from a known clean device) to freeze their accounts and change their passwords.",
    "Perform a deep scan with EDR tools to identify the specific injected DLLs or browser hooks.",
    "Review network logs for traffic to known banking trojan C2 infrastructure to determine if other hosts are infected."
  ],
  "what_to_avoid": [
    "Do not allow the user to log into *any* sensitive accounts (email, VPN, bank) from the infected machine until it is completely wiped.",
    "Avoid assuming a simple password change is sufficient; the trojan must be removed from the system first, otherwise it will just steal the new password."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}