Threat Search: 

ThreatExpert's Statistics for Trojan-Spy.Win32.Bancos.aam [Ikarus]:

Trojan-Spy.Win32.Bancos.aam [Ikarus] is also known as:
Threat AliasNumber of Incidents
Infostealer.Banker.C [Symantec]58
PWS-Banker.gen.bw [McAfee]57
Trojan-Spy.Win32.Zbot.zr [Kaspersky Lab]57
TrojanSpy.Bancos.AAM [PC Tools]55
TSPY_BANKRYPT.X [Trend Micro]55
Win-Trojan/Bancos.40960.Z [AhnLab]53
Mal/Behav-045, Mal/Zbot-A [Sophos]52
TrojanSpy:Win32/Zbot.gen!C [Microsoft]13
Mal/Behav-066, Mal/Behav-045, Mal/Zbot-A [Sophos]3
Bloodhound.Packed.31 [Symantec]2
Mal/Zbot-A [Sophos]2
Mal_MLWR-1 [Trend Micro]2
Packed.Win32.PolyCrypt.e [Kaspersky Lab]2
Win32/IRCBot.worm.variant [AhnLab]2
Win-Trojan/Polycrypt.393728 [AhnLab]2
Generic Dropper [McAfee]1
Generic PWS.y [McAfee]1
Mal/Behav-066, Mal/Zbot-A, Mal/Behav-045 [Sophos]1
Mal/Packer [Sophos]1
Mal/Zbot-A, Mal/Behav-045 [Sophos]1
New Malware.bl [McAfee]1
Trojan-Dropper.Win32.FriJoiner.nt [Kaspersky Lab]1

Trojan-Spy.Win32.Bancos.aam [Ikarus] is known to be created as:
%System%\ntos.exe
%Temp%\ldr.exe
%Temp%\micros_setup4.3.exe
Notes:
  • %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
  • %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).