New Trojan.Bancos

[rawdata]

One more Trojan

Initial link:

Code: [Select]

http://z-b.com.ua/images/stories/Comunicado.PDFwhich redirects to:

Code: [Select]

http://supplements.co.nz/images/stories/Intimacao.PDF to download the trojan

The trojan itself downloads stuff from:

Code: [Select]

http://170954-web1.spiri7.com/images/Stories/topnuevo11.pjg
and
http://server453.serverpark.dk/images/Stories/Kalv2009.jpg/Filter.php?pcnome=administrator
or

Code: [Select]

http://lajefa.fm/images/stories/topNuevo1.jpg
and
http://www.markeslevgaard.dk/images/stories/kalv2009.jpg?pcnome=Administrator