{
  "family": "banks",
  "sample_count": 1,
  "category": "trojan",
  "description": "Banks (classified in antivirus detection telemetry under designations including Trojan:Win32/Banks, Trojan.Win32.Banks, and Win32/Banks) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Banks executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Banks",
    "Trojan.Win32.Banks",
    "Win32/Banks"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Banks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Banks is a trojan threat designed to infiltrate Windows systems and execute unauthorized operations without user consent."
      }
    },
    {
      "@type": "Question",
      "name": "How does Banks compromise target systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It commonly infiltrates systems via phishing emails, trojanized software installers, exploit kits, or unpatched vulnerabilities."
      }
    },
    {
      "@type": "Question",
      "name": "What persistence mechanisms does Banks utilize?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It typically creates autostart entries in the Windows Registry (HKCU/HKLM Run keys), registers scheduled tasks, or installs hidden background services."
      }
    },
    {
      "@type": "Question",
      "name": "What risks does Banks pose to an enterprise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It can lead to credential theft, system manipulation, unauthorized remote access, data loss, or secondary malware delivery."
      }
    },
    {
      "@type": "Question",
      "name": "How can administrators detect and eliminate Banks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy modern EDR solutions with updated behavioral signatures, isolate infected endpoints, audit autostart persistence entries, and conduct full antimalware scans."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1027",
    "T1547.001",
    "T1071.001",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-16",
  "mitre_attack_detail": [
    {
      "id": "T1056.004",
      "name": "Input Capture: Credential API Hooking (Intercepting keystrokes and credentials within the browser)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1185",
      "name": "Browser Session Hijacking (Utilizing Web Injects to modify banking sites in real-time)",
      "tactic": "Collection"
    },
    {
      "id": "T1556.001",
      "name": "Modify Authentication Process: Network Device Authentication (Bypassing 2FA mechanisms)",
      "tactic": "Credential Access"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately; the trojan may be actively initiating wire transfers in the background.",
    "Instruct the user to immediately contact their financial institutions (from a known clean device) to freeze their accounts and change their passwords.",
    "Perform a deep scan with EDR tools to identify the specific injected DLLs or browser hooks.",
    "Review network logs for traffic to known banking trojan C2 infrastructure to determine if other hosts are infected."
  ],
  "what_to_avoid": [
    "Do not allow the user to log into *any* sensitive accounts (email, VPN, bank) from the infected machine until it is completely wiped.",
    "Avoid assuming a simple password change is sufficient; the trojan must be removed from the system first, otherwise it will just steal the new password."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Banks",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Banks"
    },
    {
      "name": "Kaspersky Threat Intelligence - Trojan.Win32.Banks",
      "url": "https://threats.kaspersky.com/en/threat/"
    },
    {
      "name": "MITRE ATT&CK - Enterprise Techniques",
      "url": "https://attack.mitre.org/techniques/T1059.003/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}