Threat Search: 

ThreatExpert's Statistics for Mal/DelpBanc-A [Sophos]:

Mal/DelpBanc-A [Sophos] is also known as:
Threat AliasNumber of Incidents
Trojan-Banker.Win32.Banker [Ikarus]41
PWS-Banker.gen.b [McAfee]18
Infostealer.Bancos [Symantec]17
New Win32 [McAfee]16
Trojan Horse [Symantec]16
TrojanSpy:Win32/Bancos.gen!A [Microsoft]16
TrojanSpy:Win32/Banker.USY [Microsoft]16
Trojan-Downloader.Win32.Delf.tov [Kaspersky Lab]15
Packer.RLPack [Ikarus]12
PWS-Banker [McAfee]12
Suspicious.MH690 [Symantec]11
Infostealer.Bancos!gen [Symantec]9
PWS-Banker.gen.bb [McAfee]9
Trojan-Downloader.Win32.Homa.aer [Kaspersky Lab]9
TrojanSpy:Win32/Bancos.gen!B [Microsoft]7
Bloodhound.Bancos.1 [Symantec]6
Mal_Banker [Trend Micro]5
Trojan.Generic [PC Tools]4
Trojan-Banker.Win32.Banker.amfu [Kaspersky Lab]4
Trojan-Downloader.Win32.Banload [Ikarus]4
Trojan-Dropper.Delf [Ikarus]4
Trojan-PWS.Banker.Q [Ikarus]4
Virus.Win32.Banker.BOT [Ikarus]4
Generic Downloader.x!bv [McAfee]3
HackTool.Win32.Agent.bq [Kaspersky Lab]3
PWS-Banker.gen.aa [McAfee]3
Trojan-Banker.Win32.Banker.almt [Kaspersky Lab]3
Trojan-Downloader.Delphi [Ikarus]3
Trojan-Downloader.Win32.Delf [Ikarus]3
TrojanDownloader:Win32/Banload.gen!N [Microsoft]3
Trojan-Spy.Win32.Banker.JU [Ikarus]3
TrojanSpy:Win32/Banker.GQ [Microsoft]3
Win32/MalPackedB.suspicious [AhnLab]3
Win-Trojan/Banker.680842 [AhnLab]3
Backdoor.Rbot [Ikarus]2
Downloader [Symantec]2
Generic.dx [McAfee]2
HeurEngine.Bancos [PC Tools]2
Mal_Bnkr-1 [Trend Micro]2
PWS-Banker!byo [McAfee]2
PWS-Banker.gen.i [McAfee]2
Trojan.Crypt [Ikarus]2
Trojan-Banker.Win32.Banbra [Ikarus]2
Trojan-Banker.Win32.Banker.aaus [Kaspersky Lab]2
Trojan-Banker.Win32.Banker.adlk [Kaspersky Lab]2
Trojan-Banker.Win32.Delf.af [Kaspersky Lab]2
Trojan-Banker.Win32.Qhost.da [Kaspersky Lab]2
Trojan-Downloader.Win32.Banload.lej [Kaspersky Lab]2
Trojan-Downloader.Win32.Delf.ADG [Ikarus]2
Trojan-Downloader.Win32.Delf.tne [Kaspersky Lab]2
Trojan-Spy.Win32.Banker.ciy [Ikarus]2
Trojan-Spy.Win32.Delf.fxl [Kaspersky Lab]2
TrojanSpy:Win32/Bancos.NR [Microsoft]2
Win-Trojan/Agent.386560 [AhnLab]2
Win-Trojan/QHosts.537600 [AhnLab]2
Downloader.Trojan [Symantec]1
Generic AdClicker.i [McAfee]1
Generic Malware.eb [McAfee]1
Generic.Banker.Delf [Ikarus]1
Generic.Banker.OT [Ikarus]1
Generic.dm [McAfee]1
Hacktool [Symantec]1
Infostealer.Banpaes [Symantec]1
Infostealer.opassmtp [Symantec]1
New Malware.aj [McAfee]1
P2P-Worm.Win32.Agent.gc [Kaspersky Lab]1
Packer.RLPack.D [Ikarus]1
PWS-Banker!btv [McAfee]1
PWS-Banker!bwy [McAfee]1
PWS-Banker!exq [McAfee]1
PWS-Banker!fg [McAfee]1
PWS-Banker!iy [McAfee]1
PWS-Banker.gen.ba [McAfee]1
PWS-Banker.gen.h [McAfee]1
TROJ_DLOADER.TR [Trend Micro]1
Trojan.AdClicker.AN [PC Tools]1
Trojan.PWS.Bancobras.AI [PC Tools]1
Trojan.Win32.Cosmu.faz [Kaspersky Lab]1
Trojan-Banker.Win32.Agent [Ikarus]1
Trojan-Banker.Win32.Agent.qx [Kaspersky Lab]1
Trojan-Banker.Win32.Agent.rv [Kaspersky Lab]1
Trojan-Banker.Win32.Agent.sr [Kaspersky Lab]1
Trojan-Banker.Win32.Banbra.cc [Kaspersky Lab]1
Trojan-Banker.Win32.Banbra.gwh [Kaspersky Lab]1
Trojan-Banker.Win32.Banbra.kvc [Kaspersky Lab]1
Trojan-Banker.Win32.Banbra.qkk [Kaspersky Lab]1
Trojan-Banker.Win32.Banbra.qkt [Kaspersky Lab]1
Trojan-Banker.Win32.Banker.abrf [Kaspersky Lab]1
Trojan-Banker.Win32.Banker.ahlm [Kaspersky Lab]1
Trojan-Banker.Win32.Banker.ahos [Kaspersky Lab]1
Trojan-Banker.Win32.banker.ahtp [Kaspersky Lab]1
Trojan-Banker.Win32.Banker.alre [Kaspersky Lab]1
Trojan-Banker.Win32.Banker.alua [Kaspersky Lab]1
Trojan-Banker.Win32.Banker.amqt [Kaspersky Lab]1
Trojan-Banker.Win32.Banker.anjq [Kaspersky Lab]1
Trojan-Banker.Win32.Banker.anqz [Kaspersky Lab]1
Trojan-Banker.Win32.Banker.antj [Kaspersky Lab]1
Trojan-Banker.Win32.Banker.aqgi [Kaspersky Lab]1
Trojan-Banker.Win32.Banker.aqhq [Kaspersky Lab]1
Trojan-Banker.Win32.Banker.aqor [Kaspersky Lab]1

Mal/DelpBanc-A [Sophos] has the following possible countries of origin:
OriginNumber of Incidents
Brazil197
Israel7
Germany4
Russian Federation2
China1
Croatia1
Ecuador1

Mal/DelpBanc-A [Sophos] is known to be created as:
%AppData%\spoolsv.exe
%CommonPrograms%\startup\msnmsgr.exe
%CommonPrograms%\startup\win.exe
%CommonPrograms%\startup\windows32.exe
%ProgramFiles%\adobe\reader 9.0\reader\acro-broker.exe
%ProgramFiles%\java\jre1.6.0_0_6\bin\javaws.exe
%ProgramFiles%\verbcd.exe
%System%\34itane.exe
%System%\bb.exe
%System%\chmod.exe
%System%\drivers\services.exe
%System%\gbpdist.dll
%System%\gbpsv.exe
%System%\mcieplg.dll
%System%\mspack.exe
%System%\rundll.exe
%System%\supportx.dll
%System%\svchosste.exe
%System%\svchosts.exe
%System%\wowfax2.dll
%Windir%\avg.exe
%Windir%\command\winbit.exe
%Windir%\ctflmon.exe
%Windir%\help\objsel.dll
%Windir%\regopt.dll
%Windir%\system\msnmsgr.exe
%Windir%\system\sysmod.exe
%Windir%\system\win.exe
%Windir%\windows32.dll
%Windir%\wmedia.exe
c:\bancobrasil\bb\cftmon.exe
c:\bancobrasil\bb\dda.exe
c:\mensagem.exe
c:\recadastramento bradesco 2009\recadastramento_bradesco.exe
Notes:
  • %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
  • %CommonPrograms% is a variable that refers to the file system directory that contains the directories for the common program groups that appear on the Start menu for all users. A typical path is C:\Documents and Settings\All Users\Start Menu\Programs (Windows NT/2000/XP).
  • %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
  • %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
  • %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.