{
  "family": "bnksa",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nBnksa (often part of a broader heuristic detection for \"Banker\" or \"Bnk\" Trojans) is a malicious Trojan specifically engineered to target online banking customers and financial institutions. Its primary objective is to silently intercept user interactions with targeted banking websites, harvest authentication credentials, bypass Multi-Factor Authentication (MFA), and facilitate unauthorized wire transfers directly from the victim's account.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nBnksa is typically distributed via highly targeted spear-phishing campaigns (often disguised as urgent invoices or tax documents) or through exploit kits hosted on compromised websites that silently install the payload when a vulnerable browser visits the page.\n\nOnce installed, Bnksa employs sophisticated financial theft mechanisms:\n<ul>\n<li><strong>Web Injection (Man-in-the-Browser):</strong> This is the core capability of most banking trojans. Bnksa hooks into the victim's web browser (Chrome, Firefox, Edge). When the user navigates to a targeted banking URL, the Trojan injects malicious HTML and JavaScript directly into the rendered page. This allows the malware to alter the appearance of the banking site, prompting the user for additional information (like ATM PINs or MFA tokens) that the legitimate bank would not request.</li>\n<li><strong>Form Grabbing and Keylogging:</strong> It silently records all keystrokes and captures HTTP POST data (form submissions) specifically when the user is interacting with financial sites, ensuring that usernames, passwords, and security answers are captured before they are encrypted by HTTPS.</li>\n<li><strong>Covert C2 Communication:</strong> The stolen credentials and injected data are exfiltrated to the attacker's Command and Control (C2) infrastructure, often utilizing encrypted channels or DGA (Domain Generation Algorithms) to evade perimeter firewall blocking.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Bnksa infection is a severe security incident with direct, immediate financial implications. The malware is designed to defeat standard banking security measures. If left undetected, it will result in the theft of corporate or personal financial assets.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> The highest priority is to disconnect the infected endpoint from the network to halt the active exfiltration of financial data and intercept any ongoing fraudulent transactions.</li>\n<li><strong>Financial Account Lockdown:</strong> The affected user must immediately contact their financial institutions from a known-clean device to freeze accounts, halt pending wire transfers, and report the compromise.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the deep browser hooking and system modifications utilized by banking trojans (often involving rootkit components to hide their presence), a complete bare-metal wipe and re-image from a trusted baseline is necessary.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.Bnksa",
    "Trojan-Banker.Win32.Bnksa",
    "Banker.Bnksa"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1185",
    "T1056.001",
    "T1555.003",
    "T1111"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T07:23:02Z",
  "type": "Banking Trojan",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}