There is a large campaign going on in Brazil to distribute a banking Trojan. The campaign has been going on for several years now. Unfortunately, Brazil seems to have become the most important country for banking Trojans.

Below is my Clam AV signature for the Trojan. Copy the signature, put it in the C:\ProgramData\.clamwin\db folder, and name the file sigfile.mdb. Make sure that there is no txt extenson in the filename. If you already have an MDB signature file, just add it to the existing MDB file and save the new file.

Several different files are involved in this campaign, and this signature will detect different versions of the main file that starts everything.

38912:374b689d059029b464ccc836a57bb089:Win.Trojan.Banker-042418.2009

Regards,