Banks

Overview

Trojan:Win32/Banks (often seen as Banker or Bancos) is a generic classification for 'Banking Trojans'. These are highly specialized InfoStealers explicitly designed to compromise online banking sessions, intercept credentials, bypass Two-Factor Authentication (2FA), and initiate unauthorized financial transactions (`T1056.004`). While families like Emotet or Trickbot are specific banking trojans, 'Banks' is used when the exact family cannot be identified, but the behavioral intent is clear.

Understanding Banks (Banking Trojans)
To an end-user, the infection is completely silent. They log into their bank as usual, unaware that the trojan is modifying the webpage in real-time. For a financial institution or a corporate security team, a Banking Trojan infection represents an immediate risk of direct financial theft and wire fraud.

Execution and 'Web Inject' Mechanics
Banking Trojans utilize a technique called 'Web Injects' (`T1185`). When they infect a machine, they monitor browser activity (`T1176`). When the user navigates to a targeted banking URL, the trojan intercepts the traffic and injects malicious HTML/JavaScript directly into the displayed page. This allows the trojan to present fake login fields (to steal credentials) or fake 'Security Verification' prompts (to trick the user into entering their SMS 2FA code), all while the browser shows the legitimate bank URL.

Indicators of Compromise & Impact
The impact is direct financial loss. Host-based IoCs include the presence of malicious browser extensions, unauthorized modifications to the local `hosts` file (`T1556.001`), or EDR alerts for process injection into browser executables (Chrome, Edge). Network IoCs involve the trojan communicating with its C2 server to download the latest configuration file (the 'Web Inject' list) detailing which banks to target.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.004: Monitor for unauthorized keylogging, screen capturing, or web browser API hooking. Deploy EDR to detect API hooking.
• T1185: Enforce strong MFA and use browser isolation or hardened browsers for sensitive financial or administrative portals to defeat session hijacking.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_BANKS {
    meta:
        description = "Detects Banks (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "banks" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Banks Activity
id: f3301f2aa6c52eb78ee4b79832496212
status: experimental
description: Detects generic indicators of the banks malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*banks*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint immediately; the trojan may be actively initiating wire transfers in the background.
2. Instruct the user to immediately contact their financial institutions (from a known clean device) to freeze their accounts and change their passwords.
3. Perform a deep scan with EDR tools to identify the specific injected DLLs or browser hooks.
4. Review network logs for traffic to known banking trojan C2 infrastructure to determine if other hosts are infected.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not allow the user to log into *any* sensitive accounts (email, VPN, bank) from the infected machine until it is completely wiped.
2. Avoid assuming a simple password change is sufficient; the trojan must be removed from the system first, otherwise it will just steal the new password.

References & External Analysis

• Search "banks" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Dyloader
• Premium
• Alien
• Bitmin
• Cleanlog

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/banks.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.