8/8/2019 What is a Banking Trojan and How Does It Work?

1/13

Reo} dp o kofcdfb }{ngof ofm enr mnap d} rn{c> Yoba ? nl ?0Dfln{jo}dnf Pa`{d}t Nkpa{|o}n{t

L{omhaf} }a`efdqap %yedpedfb$ }{omd}dnfohht kopam nf pn`doh afbdfaa{dfb eo|a a|nh|am df

{a`af} }djap( pyyn{}am kt }ea pa nl johro{a ofm( yo{}d`ho{ht( nl }{ngofp& Jnp} nl }eapa

johd`dnp `nma pya`djafp o{a pya`dld`ohht mapdbfam kt }ead{ o}en{p }n nk}odf a`nfnjd`

kafald}p l{nj kofc l{omp&

Reo} o{a }ea kofcdfb ]{ngofp> Reo} dfla`}dnf |a`}n{p mn }eat auyhnd}>Enr mn }eat

jofoba }n df}a{`ay} kofc `{amaf}dohp>

]eapa ofm n}ea{ qap}dnfp rdhh ka ofpra{am df }edp o{}d`ha( ofohtpdfb }ea jodf lojdhdap nl

kofcdfb }{ngofp ofm }{tdfb }n {odpa oro{afapp df }ea {aoma{ okn} }ea b{nrdfb }e{ao} nl

}eapa pya`djafp&

D Reo} dp o kofcdfb ]{ngof>

]edp }a{j {ala{p }n }ea pkpa} nl johro{a paacdfb }n p}aoh mo}o l{nj aha`}{nfd` kofc

o``nf}p& Rd}edf }edp `nf}au}( n}ea{ ldfof`doh pa{|d`ap p`e op( ln{ dfp}of`a( nfhdfa p}n`c

au`eofba nya{o}dnfp o{a ohpn `nfpdma{am aha`}{nfd` kofcdfb&

]{ngofp red`e ra{a pya`dld`ohht mapdbfam }n `oy}{a kofc dfln{jo}dnf oyyao{am df ;99=& D}

rop df }eo} tao{ }eo} of a|nh}dnf nl }{omd}dnfoh cathnbba{p ? rop fn}d`am( pdf`a pojyhapra{a ma}a`}am red`e ldh}a{am }ea `oy}{a nl mo}o o``n{mdfb }n }ea |dpd}am rakpd}ap&

L{nj }eaf nf( }ea }a`efdqap }n `oy}{a `{amaf}dohp ofm jnfd}n{ kofc rakpd}ap eo|a

ka`nja pn {aldfam }eo} }{omd}dnfoh pa`{d}t om|d`a( p`e op }n fn}d`a }ea y{apaf`a nl }ea

pa`{d}t hn`c d`nf nf }ea kofc rakpd}a n{ `ea`c }ea o}eaf}d`d}t nl }ea pa`{d}t `a{}dld`o}a(

a}`&( dp fn} afnbe&

Rd}e }ea y{ynpa }n nfht `nhha`} }ea dfln{jo}dnf l{nj rakpd}ap |dpd}am kt }ea pa{( }eapa

}{ngofp pohht bo}ea{ ofm ymo}a kofc hdp}p( ad}ea{ df d}p knmt n{ df o `nfldb{o}dnf ldha }eat

`{ao}a n{ mnrfhnom l{nj o johd`dnp pa{|a{& Pnja nl }eapa }{ngofp eo|a eba hdp}p nl kofc

o`}d|d}t jnfd}n{dfb p}{dfbp3 ln{ dfp}of`a( }ea Pdfnroh lojdht pap jn{a }eof ;999&

?

]edp dp o }tya nl }{ngof }eo} {a`n{mp ofm p}n{ap }ea catp}{ncap joma nf }ea catkno{m& ]edp dfln{jo}dnf %red`e jot kapafpd}d|a$ dp pkpaqaf}ht paf} }n }ea o}}o`ca{( ren jot pa d} ln{ }ead{ nrf kafald}& ]ea hop} |a{pdnfp nl }edp }tya nljohd`dnp pnl}ro{a ohpn ya{ln{j p`{aafpen}p nl }ea o}}o`cam `njy}a{& ]ea{aln{a( }ea pa nl }ea |d{}oh catkno{m dpdfalla`}d|a ofm fn} pa`{a&

REO] DP O KOFCDFB ][NGOF OFM ENR MNAP D] RN[C>

DFLN[JO]DNF PA@Q[D]T NKPA[\O]N[T

Dfp}d}q}nFo`dnfohma]a`fnhnbopmaho@njqfd`o`df

NKPA[\O]N[T

Fn}aknnc

8/8/2019 What is a Banking Trojan and How Does It Work?

2/13

Djoba ?7 Pjohh l{objaf} nl }ea kofc jnfd}n{dfb ldha nl o kofcdfb ]{ngof %Pdfnroh( ]n{ydb(

Ofpa{df$

Pnq{`a7 DF]A@N

]ea{a o{a }rn jodf }{afmp df kofcdfb johro{a( mayafmdfb nf }ea `nf}{t nl n{dbdf nl }ea

mapdbfa{p nl }ea johd`dnp `nmap( }ea K{owdhdof ofm }ea [ppdof& Df bafa{oh( [ppdof

p`ennh pojyhap o{a pohht j`e jn{a pnyedp}d`o}am ofm pdhaf}& D} rnhm ohpn ka ynppdkha

}n jaf}dnf @edfo ofm Cn{ao op n}ea{ aja{bdfb `nf}{dap df }ea bafa{o}dnf nl }edp }tya nl

johd`dnp `nmap&

DD @{{af} pd}o}dnf nl `njy}a{p dfla`}am rd}e }{ngofp ofm kofcdfb }{ngofp

Df n{ma{ }n edbehdbe} }ea djyn{}of`a nl }edp }tya nl johd`dnp `nmap( ofm op `of ka paaf df

}ea b{oye kahnr( `{{af}ht %Pay}ajka{ ;994$( 2&;! nl ofohtpam `njy}a{p enp} pnja

ln{j nl kofcdfb }{ngof&

B{oye ?7 A|nh}dnf nl `njy}a{p enp}dfb kofcdfb }{ngofp %!$

=?&5! =9&4! =9&0!01&=!

4&?! 5&5! 5&1! 2&;!

9!

?9!

;9!

09!

=9!

19!

Yoba ; nl ?0Dfln{jo}dnf Pa`{d}t Nkpa{|o}n{t

8/8/2019 What is a Banking Trojan and How Does It Work?

3/13

Reo} dp o kofcdfb }{ngof ofm enr mnap d} rn{c> Yoba 0 nl ?0Dfln{jo}dnf Pa`{d}t Nkpa{|o}n{t

]edp {ayn{} `n|a{p }ea jnp} ynyho{ lojdhdap nl kofcdfb }{ngofp }eo} `o{{t n} o}}o`cp

obodfp} kofcp;7

kof`np( kofc( kofca{( pdhaf}kofca{( wkn}( pdfnroh( }n{ydb( l{oqm( waqp( dflnp}aoha{( ojkha{(

p}aoha{( tappdj( tohqmha( kofhnom( kofcyo}`e( jqh}dkofca{( fa}eahh( `e{njadfga`}( bnhmqf(

kofpyt( kof`nmnn{ ofm kof`nmn&

Reaf df}a{y{a}dfb }ea mo}o d} dp appaf}doh }n {ajajka{ }eo} `njy}a{p enp}dfb kofcdfb

johro{a mn fn} fa`appo{dht afm y df o l{omhaf} pd}o}dnf& Df n{ma{ ln{ o l{om }n n``{(

}e{aa `d{`jp}of`ap o{a {aqd{am7

?$ ]ea pa{p `njy}a{ jp} ka dfla`}am rd}e }edp }tya nl }{ngofp&

;$ ]ea pya`djaf }eo} dfla`}am }ea pa{p `njy}a{ faamp }n o}}o`c }ea kofc

}e{nbe red`e }ea pa{ jocap }{ofpo`}dnfp&

0$ ]ea pa{ jp} hnb df }n d}p nfhdfa kofcdfb pyo`a ofm ldhh df }ea ommd}dnfoh mo}o

{aqap}am&

DDD Reo} }a`efdqap mn }eapa }{ngofp pa }n jnfd}n{ |dpd}p }n kofcdfb

rakpd}ap>

]ea ldh}a{dfb nl }ea pa{p mo}o dp ya{ln{jam pdfb hdp}p nl kofcp }n ka jnfd}n{am& ]eapa

hdp}p `nf}odf }au} p}{dfbp p`e op7

]ea Q[H nl }ea kofc }eo} dp }ea }o{ba} nl }ea yedpedfb o}}o`c7

e}}y7..rrr&jdkof`n&`nj

Pkp}{dfbp nl }ea kofcp Q[H7 'jdkof`n&`nj

]ea rdfmnr }d}ha nl }ea nfhdfa kofcdfb rakpd}a7 JdKof`n Df}a{fa} Auyhn{a{

Pya`dld` p}{dfbp nl }ea knmt nl }ea nfhdfa kofcdfb rakpd}a7 JdKof`n ;995& Ohh

{dbe}p {apa{|am&

Rakpd}ap E]JH `nma p}{dfbp {aho}am }n }ea ln{jp pam }n o``app }ea ya{pnfoh

o``nf}7 8hokah ln{:+hb^pa{foja+ `hopp:+hokpa{^9?+6

Df n{ma{ }n ka okha }n `njyo{a }eapa p}{dfbp rd}e }ea fojap( ofm n}ea{ yo{oja}a{p( nl }ea

rakpd}ap |dpd}am( }ea{a jp} ka o ja`eofdpj }eo} ya{jd}p }ea df}a{o`}dnf rd}e }ea `nf}au}

nl }ea |dpd}am pd}a& ]ea jnp} poh ja}enmp o{a }ea df}a{`ay}dnf nl Rdfmnrp OYD lf`}dnfp

;

]ea{a o{a n}ea{ lojdhdap nl }{ngofp }eo} `of ka pam }n `njjd} l{om( a|af }enbe }edp dp fn} }ead{ jodf n{ nfht y{ynpa& Ln{dfp}of`a( bafa{d` cathnbba{p jot ka pnja}djap pam }n `oy}{a kofcdfb `{amaf}dohp& Pdjdho{ht( }{omd}dnfoh ko`cmnn{ }{ngofpohhnr jocdfb {ajn}a p`{aafpen}p ofm |dardfb reo} }ea pa{ }tyap& Op o {aph}( }eapa `nhm ka pam kt of o}}o`ca{ }ndf}a{`ay} {amaf}dohp nl nfhdfa kofcdfb ofm yotjaf} pa{|d`ap& ]eapa lojdhdap o{a fn} kadfb n|a{am df }edp ofohtpdp&

8/8/2019 What is a Banking Trojan and How Does It Work?

4/13

%enncp$( Df}a{fa} Auyhn{a{ au}afpdnfp %KENp( K{nrpa{ Eahya{ Nkga`}p$ n{ Ld{alnu

au}afpdnfp( }ea dfpya`}dnf nl nyaf rdfmnrp( MMA( @NJ.NHA df}a{lo`ap ofm }ea

dfp}ohho}dnf nl m{d|a{p df }ea ptp}aj&

D\ Enr mn }{ngofp jofoba }n p}aoh kofcdfb `{amaf}dohp>

]ea okn|a jaf}dnfam ja}enmp }n jnfd}n{ kofcp o{a ohpn palh( df jnp} `opap( }n `oy}{a

kofc mo}o& O jn{a pya{ld`doh `hoppdld`o}dnf nl }{ngofp dp pohht joma o``n{mdfb }n }ea

}a`efdqa pam }n `oy}{a pa{ mo}o& ]ea lnhhnrdfb o{a }ea jnp} rdmapy{aom ja}enmp7

Cathnbbdfb

Ln{j mo}o `oy}{a

P`{aaf `oy}{ap ofm |dman {a`n{mdfb

Dfga`}dnf nl l{omhaf} ln{j ldahmp

Dfga`}dnf nl l{omhaf} rakpd}ap

[amd{a`}dfb nl kofcdfb rakpd}ap

Jof*df*}ea*jdmmha }a`efdqa

Cathnbbdfb

]edp lf`}dnfohd}t dp ya{ln{jam kt cathnbba{p( renpa odj dp }n p}aoh yopprn{mp( df}a{`ay}

dfp}of} jappobdfb `nf|a{po}dnfp n{ r{d}}af ajodhp ofm `nhha`} mo}o l{nj }eaj( a}`& ]ea

kofcdfb }{ngofp eo|a `njkdfam }eapa }a`efdqap rd}e kofc jnfd}n{dfb ja}enmp df n{ma{

}n ldh}a{ fdf}a{ap}dfb dfln{jo}dnf ofm `oy}{a a|a{t catp}{nca nf pya`dld` kofc rakpd}ap&

]edp dp fn} o |a{t alla`}d|a ja}enm( pdf`a jnp} kofcp {aqd{a pnja `{amaf}dohp }n ka

af}a{am kt o jaofp n}ea{ }eof }ea catkno{m& L{}ea{jn{a( dl o pa{ jocap o jdp}oca ofm

maha}ap( }tydfb }ead{ yopprn{m obodf( }edp jocap d} mdlld`h} }n mdp`{djdfo}a }ea `n{{a`}

`{amaf}dohp&

]edp }eal} ja}enm dp bafa{ohht pam df `njkdfo}dnf rd}e n}ea{ }a`efdqap ofm

`nfpaqaf}ht d}p }e{ao} dp aqohht edbe&

Ln{j mo}o `oy}{a

Cathnbbdfb dp fn} o |a{t alld`daf} rot nl `oy}{dfb kofc `{amaf}dohp& Dl o johd`dnp `nma

`oy}{ap a|a{t catp}{nca rd}en} oyyhtdfb oft ldh}a{p( }ea o}}o`ca{ rdhh y{nkokht ldfm

jh}dyha mo}o rd}e of fdf}ahhdbdkha p}{`}{a& ]edp dp ret johro{a o}en{p eo|a a|nh|am }n

`oy}{a kofcdfb ln{jp&

Reo} dp o kofcdfb }{ngof ofm enr mnap d} rn{c> Yoba = nl ?0Dfln{jo}dnf Pa`{d}t Nkpa{|o}n{t

8/8/2019 What is a Banking Trojan and How Does It Work?

5/13

]edp ja}enmp om|of}oba dp }eo} d} ldh}a{p ofm p}{`}{ap jn{a alla`}d|aht }ea `oy}{am mo}o

ofm }ea }eal} nl dfln{jo}dnf p}dhh n``{p y{dn{ }n af`{ty}dnf( red`e dp bafa{ohht pam }n pafm

}ea mo}o( afokhdfb }n bo}ea{ }eapa df pdjyha yhodf }au} ln{jo}&

Djoba ;7 Auojyha nl mo}o `nhha`}am kt o ln{j `oy}{dfb }{ngof }eo} dfga`}p o l{omhaf}

rakpd}a {aqap}dfb `a{}odf ldahmp nl }ea cat `nma `o{m

Pnq{`a7 DF]A@N

P`{aaf `oy}{ap ofm |dman {a`n{mdfb

Nf joft n``opdnfp( hnbdf yobap df nfhdfa kofcdfb rakpd}ap df`hma |d{}oh catkno{mp %nf*

p`{aaf catkno{mp$ }n y{a|af} catp}{ncap l{nj kadfb hnbbam n{ ln{j `{amaf}dohp l{nj kadfb

`oy}{am( dl }ea af}a{am mo}o o{a `n{{a`}ht nklp`o}am& Rd}e }ea odj nl pcdyydfb }edp

pa`{d}t hota{( o}en{p nl kofcdfb }{ngofp eo|a }{fam }n p`{aaf `oy}{dfb }a`efdqap&

]ea p`{aaf dp pohht `oy}{am a|a{t }dja o jnpa `hd`c dp fn}d`am nf }ea nfhdfa kofcdfb

pd}a( d&a& }ocdfb o p`{aafpen} nl }ea yoba }ea pa{ dp |dardfb reaf o``appdfb }ea nfhdfakofcdfb rakpd}a& Pdf`a }n pafm lhh p`{aaf `oy}{ap }n }ea o}}o`ca{ rnhm af}odh

`nfpdma{okha radbe}( ma }n }ea ho{ba pdwa %df jabokt}ap$ nl }ea mdbd}oh djobap {aph}dfb

l{nj }ea p`{aaf `oy}{a( }edp }tya nl johro{a pohht `oy}{ap nfht yo{}p nl }ea auo`}

hn`o}dnf rea{a }ea jnpa `hd`c n``{{am&

A{{n{/ Fn pa af`af}{o ah n{dbaf ma ho {ala{af`do& penrp o }tyd`oh |d{}oh catkno{m df

of nfhdfa kofcdfb o}eaf}d`o}dnf yoba ofm( }n d}p {dbe}( }ea p`{aaf `oy}{a nl }ea hnbdf mo}o

}ocaf kt o kofcdfb }{ngof( olla`}dfb o `njy}a{ }eo} dp }{tdfb }n o``app }edp kofc&

Reo} dp o kofcdfb }{ngof ofm enr mnap d} rn{c> Yoba 1 nl ?0Dfln{jo}dnf Pa`{d}t Nkpa{|o}n{t

8/8/2019 What is a Banking Trojan and How Does It Work?

6/13

Djoba 07 Auojyha nl mo}o `nhha`}am kt o ln{j `oy}{dfb }{ngof }eo} dfga`}p o l{omhaf}

rakpd}a {aqap}dfb `a{}odf ldahmp nl }ea cat `nma `o{m

Pnq{`a7 DF]A@N

Df |dar nl }edp }e{ao}( joft kofcdfb af}d}dap eo|a ma`dmam }n djyhajaf} ja}enmp }n

`eofba }ea fjka{p oyyao{dfb nf }ea p`{aaf( reaf }eapa o{a af}a{am df }ea mo}o ldahmp(

ln{ op}a{dpcp( reaf jnpa `hd`cdfb& ]ea johd`dnp `nma o}en{p eo|a ny}am ln{ n}ea{ }eal}

ja}enmp p`e op {a`n{mdfb o pen{} |dman `hdy nl }ea renha hnbdf y{n`app&

Dfga`}dnf nl l{omhaf} ln{j ldahmp

]ea{a o{a fnromotp om|of`am ja}enmp ln{ }ea o``app ofm o}eaf}d`o}dnf nl pa{p }n

`nfm`} ldfof`doh }{ofpo`}dnfp( p`e op( ln{ auojyha( }ea cat `nma `o{mp& ]nmot d} dp

fpoh }n ldfm o ldfof`doh af}d}t }eo} eop fn} oft }tya nl cat `nma `o{m n{ pa`nfmo{t cat

`nma pam }n `o{{t n} kofcdfb }{ofpo`}dnfp n{ n}ea{ cdfm nl }{ofpo`}dnfp& Rd}en} }edp

dfln{jo}dnf of o}}o`ca{ `nhm nfht cfnr o pa{dap nl mo}o p`e op7 `{amd} `o{m mo}o(

ya{pnfoh ofm pa{ mo}o( o``nf} kohof`a( o``nf} }{ofpo`}dnfp ofm {a`n{mp( a}`& k} }eat

rnhm fa|a{ ka okha }n p}aoh( d&a& }n joca o }{ofpo`}dnf df n{ma{ }n }{ofpla{ lfmp l{nj n{o``nf} }n ofn}ea{ }eo} dp jofobam kt }ea o}}o`ca{&

Pnja kofcp y{n|dma cat `nma `o{mp rd}e ?99 mdlla{af} knuap& Df n{ma{ }n `oy}{a ohh d}p

`nmap( }ea }{ngof penhm pyt ?99 }{ofpla{p ofm ao`e nl }eaj penhm eo|a ao`e nl }ea ?99

`o{m `nmap& ]edp df|nh|ap }nn j`e }dja ln{ nfhdfa `{dja b{nyp( red`e( }n o``aha{o}a }ea

y{n`app( pnja}djap ma`dma }n dfga`} ommd}dnfoh ldahmp df}n }ea habd}djo}a kofcdfb ln{j nl o

kofc df n{ma{ }n `oy}{a }ea om|of`am kofcdfb `{amaf}dohp& ]edp af}odhp dfpa{}dfb ldahmp df}n

}ea rakpd}a( red`e oyyao{ }n ka ya{la`}ht df}ab{o}am df}n d} ofm joca }ea pa{ oppja d} dp

}ea kofc d}pahl }eo} dp {aqap}dfb }enpa mo}o ln{ o``app&

Reo} dp o kofcdfb }{ngof ofm enr mnap d} rn{c> Yoba < nl ?0Dfln{jo}dnf Pa`{d}t Nkpa{|o}n{t

8/8/2019 What is a Banking Trojan and How Does It Work?

7/13

Djoba =7 Auojyha nl dfga`}dnf nl o l{omhaf} ln{j ldahm df}n o kofcp habd}djo}a rakpd}a&

Pnq{`a7 DF]A@N

Lo`dfb }ea dfga`}dnf penrf df Djoba =( o fn} |a{t `o}dnp pa{ rnhm af}a{ }ead{

pdbfo}{a cat %df }ea auojyha df }ea {dbe} d} dp }ea ldahm yho`am gp} okn|a }ea Af}a{

k}}nf$( a|af rd}en} df}afmdfb }n jocdfb o }{ofpo`}dnf& Kt mndfb }edp( a|af }enbe }ea

pa{ rdhh fa|a{ `o{{t n} }ea }{ofpla{( }ea o}}o`ca{ rdhh eo|a }ea fa`appo{t mo}o }n `o{{t n}

}ea o}}o`c&

Fn}a }eo} }ea rakpd}ap pa`{d}t `a{}dld`o}a( df }eapa `opap( `nf}dfap }n ka }ea habd}djo}a

`a{}dld`o}a nl }ea kofc3 }ea l{om n``{p o} oyyhd`o}dnf ha|ah( ol}a{ }ea `nffa`}dnf dp

af`{ty}am&

Dfga`}dnf nl l{omhaf} yobap

D} dp o ja}enm pdjdho{ }n }ea y{a|dnp nfa7 }ea nfht mdlla{af`a hdap df }eo} rd}e }edp

}a`efdqa( lhh yobap o{a dfga`}am df}n }ea nfhdfa kofcdfb pappdnf& ]ea k{nrpa{ caayp

mdpyhotdfb }ea kofcp habd}djo}a pa`{d}t `a{}dld`o}a( k} }ea yoba oyyao{dfb nf }ea p`{aaf

dp lohpa&

]edp loca yoba pohht opcp }ea pa{ ln{ ohh( n{ fao{ht ohh }ea ldahmp nl }ea cat `nma `o{m n{

oft n}ea{ pa`nfmo{t `nma red`e `nhm ka {aqd{am }n `o{{t n} }ea }{ofpla{&

Reo} dp o kofcdfb }{ngof ofm enr mnap d} rn{c> Yoba 2 nl ?0Dfln{jo}dnf Pa`{d}t Nkpa{|o}n{t

8/8/2019 What is a Banking Trojan and How Does It Work?

8/13

Djoba 17 N{dbdfoh hnbdf yoba %okn|a$ nl of nfhdfa kofcdfb rakpd}a ofm loca yoba %kahnr$

dfga`}am }n `oy}{a }ea catp {aqd{am }n joca nfhdfa }{ofpla{p&

Pnq{`a7 DF]A@N

Q[H {amd{a`}dnf

]edp }a`efdqa dp `ohham yeo{jdfb ofm d}p nkga`} dp }n lohpdlt }ea MFP {apnh}dnf nl `a{}odf

rakpd}ap rd}e }ea odj }n {amd{a`} }ea |d`}dj }n o rakpd}a }eo} dp dmaf}d`oh }n }ead{ habd}djo}a

kofcdfb rakpd}a& ]ea pa`{d}t `a{}dld`o}a( dl d} audp}p( dp fn} }ea habd}djo}a `a{}dld`o}a nl }ea

kofc&

Pdjyht auyhodfam( }ea MFP {apnh}dnf y{n`app dp op lnhhnrp7 reaf o pa{ }tyap o rakpd}a

omm{app df }ea k{nrpa{ %a&b& rrr&jdmd{a``dnf&ap$( }edp jp} {apnh|a }n of DY omm{app(

red`e dp auy{appam df fjka{p %a&b& ?4;&? Yoba 5 nl ?0Dfln{jo}dnf Pa`{d}t Nkpa{|o}n{t

8/8/2019 What is a Banking Trojan and How Does It Work?

9/13

Reo} dp o kofcdfb }{ngof ofm enr mnap d} rn{c> Yoba 4 nl ?0Dfln{jo}dnf Pa`{d}t Nkpa{|o}n{t

Djoba

Nf`a }ea nfhdfa kofcdfb mo}o o{a `oy}{am( }eapa jp} ka yoppam }n }ea o}}o`ca{ ln{

edj.ea{ }n ka okha }n p}aoh }eaj& Reaf yedpedfb n{ yeo{jdfb dp pam( }ea l{omhaf}

pa{|a{ d}pahl( red`e `nf}odfp }ea `nydap nl }ea habd}djo}a kofcdfb rakpd}ap( rdhh ofohtpa

ofm y{n`app }ea mo}o( po|a }eaj df }ea `njy}a{ n{ pafm }eaj }n }ed{m*yo{}t `njy}a{p&

K}( reo} eoyyafp reaf }ea mo}o o{a `oy}{am kt oft n}ea{ ja}enm>

]ea }{ngof faamp }n pafm }eapa mo}o }n }ea o}}o`ca{ df n{ma{ ln{ edj.ea{ }n pa }eaj& ]n

mn }edp( }ea jnp} poh }a`efdqap o{a7

Pafmdfb }e{nbe E]]Y YNP] ofm BA] {aqap}p7 pdfb }ea poja y{n}n`nh 0 red`e

oft pa{ ajyhntp }n {aqap} ofm ka okha }n paa Df}a{fa} rakpd}ap&

@nffa`}dnf }n o PJ]Y pa{|a{( ofm bafa{o}dnf nl of aha`}{nfd` jodh jappoba

`nf}odfdfb }ea p}nhaf mo}o( red`e dp paf} }n of o``nf} `nf}{nhham kt }ea o}}o`ca{&

O``app }n o L]Y pa{|a{ nrfam kt }ea o}}o`ca{( ofm pafmdfb nl o `nyt nl }ea ldha

`nf}odfdfb }ea mo}o p}nhaf l{nj }ea enja `njy}a{&

0Pa} nl hnbd`oh ofm y{nb{ojjdfb {hap pam o}njo}d`ohht kt `njy}a{p }n `njjfd`o}a rd}e ao`e n}ea{( a&b& }n `nffa`} o

enja `njy}a{ }n }ea Df}a{fa} ofm |dpd} o rakpd}a }eo} dp enp}am df ofn}ea{ `njy}a{ n{ pa{|a{&

8/8/2019 What is a Banking Trojan and How Does It Work?

10/13

Reo} dp o kofcdfb }{ngof ofm enr mnap d} rn{c> Yoba ?9 nl ?0Dfln{jo}dnf Pa`{d}t Nkpa{|o}n{t

D[@ `nffa`}dnfp o{a ohpn pam }n pafm }ea p}nhaf mo}o }n o `eo} `eoffah(

yo{}d`ho{ht |dpdkha df kn}fa}p=( oh}enbe {a`af}ht }ea ptp}ajp }n pafm }enpa p}nhaf

mo}o o{a a|nh|dfb }nro{mp }ea pafmdfb }e{nbe E]]Y y{n}n`nh&

Df ommd}dnf( pn op fn} }n {odpa ppyd`dnfp( }ea p}nhaf mo}o o{a pohht af`{ty}am kaln{a

}ead{ pafmdfb }n }ea o}}o`ca{3 }ea{aln{a( oftnfa jnfd}n{dfb }ea }{olld` rdhh ma}a`} p}{ofba

`njjfd`o}dnfp k} rdhh fn} ka okha }n paa }ea p}nhaf dfln{jo}dnf&

Djoba 27 Pafmdfb nl af`{ty}am p}nhaf mo}o pdfb }ea E]]Y y{n}n`nh&

Pnq{`a7 DF]A@N

Df {a`af} jnf}ep( d} eop kaaf `njjnf ojnfb `tka{`{djdfohp }n pa {aoh rak yn{}ohp(au`hpd|aht `{ao}am ln{ }eo} y{ynpa( }n `nhha`} p}nhaf mo}o& ]eapa yn{}ohp `nf}odf o mo}o

kopa ofm o pa} nl p`{dy}p %y{nb{ojjdfb `nmap$ red`e y{n`app }ea mo}o ofm joca }eaj

o``appdkha kt jaofp nl o pdjyha b{oyed`oh df}a{lo`a( rea{a oft fpcdhham pa{ `of

ya{ln{j pao{`eap kt `nf}{t( kofc( `oy}{a mo}a( a}`&

]eapa o{a `nf}{nh yofahp }eo}( nf joft n``opdnfp( ohhnr }ea o}}o`ca{ }n oppdbf }opcp }n

}ea dfla`}am `njy}a{p( {ofbdfb l{nj pe}}dfb mnrf }ea `njy}a{ }n bafa{o}dfb o joppd|a

o}}o`c df n{ma{ }n ba} o Mafdoh nl Pa{|d`a %MnP$1 ofm a|af pdfb }eapa `njy}a{p }n enp}

yedpedfb n{ mdp}{dk}a johro{a&

D} dp df}a{ap}dfb }n jaf}dnf }ea yedpedfb o}}o`cp }eo} }{t }n edma }eajpah|ap kt pdfb

kn}fa}p3 dl }edp dp }ea `opa( }ea `njy}a{p dfla`}am rd}e johd`dnp `nma rnhm ka`nja

edmmaf y{nudap< ofm( `nfpaqaf}ht( }ea yedpedfb rnhm {apnh|a l{nj of DY }n ofn}ea{

=]eapa fa}rn{cp o{a pa}p nl `njy}a{p }eo} eo|a kaaf dfla`}am rd}e o `a{}odf }tya nl johd`dnp pnl}ro{a( rd}e ko`cmnn{

lf`}dnfohd}t( red`e afokhap }ea o}}o`ca{ }n `nf}{nh }enpa `njy}a{p rd}en} eo|dfb yetpd`oh o``app }n }eaj ofm rd}en} }eanrfa{p cfnrhamba( pdfb }eaj op {aoh {nkn}p %eaf`a d}p n{dbdf7 {nKn} # Fa}$& ]edp( }nba}ea{ rd}e d}p hnr `np} ofm }ea rdma|o{da}t nl auyhnd}o}dnf }a`efdqap( jocap d} nfa nl }ea jnp} djyn{}of} dhhabd}djo}a n{ dhhaboh ja}enmp df }ea Fa}&

1Mafdoh nl pa{|d`a dp fma{p}nnm( rd}edf }ea `njy}a{ pa`{d}t ldahm( op o `nhha`}dnf nl }a`efdqap odjam }n mdpokha o pa{|a{&

]ea odj nl }edp }tya nl o}}o`cp dp }n n|a{hnom o pa{|a{ pn }eo} }ea habd}djo}a pa{p o{a fn} okha }n pa }ea pa{|d`ap y{n|dmam

kt }ea pa{|a{ d}pahl&

Nf`a }ea o}}o`ca{p ynppapp }ea `{amaf}dohp ofm mo}o {aqd{am }n o``app }ea kofc

o``nf}p( }eat faam }n }oca jnfat l{nj }eaj&

Df n{ma{ }n edma }ead{ dmaf}d}t( o}}o`ca{p }{omd}dnfohht pam o jha& ]eapa jhap o{a

dfmd|dmohp ren( kahda|dfb }eat o{a mndfb o `njyha}aht haboh rn{c ln{ o `a{}odf pj nl

jnfat( kaeo|a op o k{dmba( rd}en} }ead{ cfnrdfb( ln{ mkdnp nfhdfa kofcdfb

}{ofpo`}dnfp( ofm ren a|af}ohht ka`nja {apynfpdkha ln{ }ea l{om `njjd}}am reaf o`}dfb

op o l{nf} ln{ }ea `{djdfoh& D} jp} ka p}{appam obodf }eof }eapa jhap o{a fn{joh pa{p(

o`}dfb df bnnm lod}e( ren kahda|a }eat o{a `o{{tdfb n} o yodm }opc ln{ o `njyoft n{ }ed{m

yo{}t( ofm ren o{a pohht {a`{d}am }n ya{ln{j }eapa o`}dnfp kt jaofp nl loca Df}a{fa}

gnk nlla{p&

]ea }eal} }{ofpla{ ptp}aj rn{cp op lnhhnrp7 }ea o}}o`ca{p o``app }ea pa{ o``nf}( }ea

mo}o nl red`e }eat cfnr( rd}e }ea p}nhaf `{amaf}dohp( ofm `o{{t n} o }{ofpo`}dnf }n of

o``nf} red`e eop kaaf y{a|dnpht nyafam kt }ea jha( red`e dp nl }ead{ nrfa{pedy(

edbehdbe}dfb obodf }eo} rd}en} cfnrdfb }eo} }eat o{a o`}ohht `njjd}}dfb o `{dja&

Reo} dp o kofcdfb }{ngof ofm enr mnap d} rn{c> Yoba ?? nl ?0Dfln{jo}dnf Pa`{d}t Nkpa{|o}n{t

8/8/2019 What is a Banking Trojan and How Does It Work?

12/13

Nf`a }ea `tka{`{djdfoh pafmp }ea jnfat l{nj }ea pa{p kofc o``nf} l{nj red`e }ea

mo}o eo|a kaaf p}nhaf }n }ea jha( }ea jha }ocap }ea jnfat l{nj }ead{ o``nf} ofm

mahd|a{p }eaj }n }ea o}}o`ca{ n{ o mahabo}a nl }eaj( ad}ea{ kt eofm n{( jn{a pohht(

}e{nbe }{ofpo`}dnfp }n o``nf}p ok{nom red`e o{a nrfam kt }ea `{djdfoh ofm mn fn}

hao|a oft }{o`a& Bafa{ohht( df }edp }tya nl p`ojp( }ea jha dp }ea nfht |dpdkha dmaf}d}t( ofm

o} kap} }edp rnhm ka okha }n dmaf}dlt }ea o}}o`ca{ ren {a`{d}am edj.ea{ }n `o{{t n} }enpa

pa{|d`ap ofm pafm }ea }{ofpla{p&

]edp jnmah `of ka`nja `njyhau kt eo|dfb pa|a{oh df}a{jamdo}a jhap ren }{ofpla{ }ea

jnfat ka}raaf }ead{ o``nf}p f}dh o hop} yndf} dp {ao`eam rea{a }ea jnfat dp }{ofpla{{am

}n }ea o}}o`ca{&

Ofn}ea{ rdmapy{aom pa{|d`a pam kt o}}o`ca{p }n nk}odf jnfat dp }ea pa{|d`a nl }{ofpla{ }nof O]J jo`edfa& ]ea jha `of n{ma{ o md{a`} }{ofpla{ }n of O]J jo`edfa( }n red`e o

`nma dp oppdbfam& ]edp rot( oft pa{ %}ea o}}o`ca{$ cfnrdfb }eo} `nma `of bn }n of

o}njo}am `ope jo`edfa ofm {ajn|a }ea `ope n{ma{am kt }ea }{ofpo`}dnf& ]ea o}}o`ca{

nfht faamp }n `nffa`} }n }ea kofcdfb pyo`a nl o pa{ p{ydfb }ead{ dmaf}d}t rd}e }ea

y{a|dnpht p}nhaf `{amaf}dohp( `o{{t n} }edp }{ofpo`}dnf ofm bn }n o `ope jo`edfa ofm ba}

}ea jnfat&

Nk|dnpht( op o}en{d}dap ofm hor afln{`ajaf} obaf`dap p}o{} ofohtpdfb ofm bndfb ol}a{

}edp }tya nl l{omp( o}}o`ca{p ohpn {aldfa }ead{ }a`efdqap& Ofn}ea{ qd}a dfbafdnp ja}enm

}n }oca }ea jnfat l{nj }ea o``nf}p nl red`e }ea mo}o o{a cfnrf dp }n nyaf of nfhdfa

`opdfn& Qpdfb }ea p}nhaf `{amd} `o{mp ofm o``nf}p( }ea o}}o`ca{ rdhh |dpd} }ea `opdfn

`{ao}am kt }eaj ofm bojkha rd}e }ea y{ynpa nl hnpdfb ohh }ea jnfat audp}dfb df }enpa

o``nf}p&

]eapa hnppap rdhh o`}ohht ka`nja y{nld}p ln{ }ead{ `opdfn( l{nj red`e }ea o}}o`ca{ rdhh ka

okha }n }oca ohh }ea jnfat rd}en} {odpdfb haboh ppyd`dnfp& ]edp `of ohpn ka mnfa kt

`{ao}dfb loca nfhdfa ka}}dfb rakpd}ap n{ pdjho}dfb n}ea{ pa{|d`ap y{n|dmam kt }ea Df}a{fa}&

Reo} dp o kofcdfb }{ngof ofm enr mnap d} rn{c> Yoba ?; nl ?0Dfln{jo}dnf Pa`{d}t Nkpa{|o}n{t

8/8/2019 What is a Banking Trojan and How Does It Work?

13/13

Reo} dp o kofcdfb }{ngof ofm enr mnap d} rn{c> Yoba ?0 nl ?0

Djoba 47 Yofah `nf}{nh nl o kofcdfb ]{ngof& O{ao pam }n nfldb{a }ea E]JH dfga`}dnfp&

Pnq{`a7 DF]A@N

]ea `nf}{nh yofah df Djoba 4 dp yo{}d`ho{ht df}a{ap}dfb op d} penrp o edbeht dffn|o}d|a

ja}enm }n p}aoh kofcdfb `{amaf}dohp& Dl ra hnnc o} }ea }okp df }ea `nf}{nh jaf( ra rdhh paa

nfa `ohham O}n}{ofpla{p&

]ea o}}o`ca{ `of `nfldb{a }ead{ }{ngof }n joca }{ofpla{p o}njo}d`ohht reaf o habd}djo}a

pa{ o``appap }ead{ o``nf}& ]ea |d`}dj rdhh joca o }{ofpla{ }n o habd}djo}a o``nf} nl}ead{ `end`a( k} }ea }{ngof rdhh df}a{`ay} }eo} {aqap} ofm `eofba }ea }o{ba} o``nf}( a|af

}enbe }ea o``nf} paha`}am kt }ea pa{ dp }ea nfa mdpyhotam nf }ea p`{aaf& ]ea pa{ rdhh

}eaf af}a{ }ead{ `{amaf}dohp }n joca }eo} }{ofpla{ ofm }ea jnfat rdhh ka md{a`}ht paf} }n }ea

o}}o`ca{& Kt pdfb }edp ja}enm d} dp ohrotp }ea |d`}dj ren jocap }ea }{ofpla{( }ea{a o{a fn

jhap df|nh|am n{ faam }n o``app }ea o``nf} l{nj o mdlla{af} `njy}a{&