This Trojan disguises itself as a banking application for Bradesco, one of the largest private-sector banks. It has a browser-like GUI, which contains buttons and hyperlinks that are not functional.

This Trojan poses as a legitimate application from Bradesco that allows users to log in to their bank accounts. When the user first tries to log in to an account via this seemingly harmless application, it displays a message informing the user that the account will expire within five days. The user is then asked reenter personal detains to renew the account. The application refuses to shut down when the user tries to close the application window without entering any information.

If the user enters the information, and completes the next three steps successfully, the application to connect to http://web67.xx.xx.xx.br by sending three packets of length 252 bytes, 2127 bytes, and 186 bytes. It uses socket-based connections on the local port number 1085 and uses proxy-forwarding with an entire branch of login ids to make it difficult to track the packets.

The information regarding the Web site is as follows:

In last two packets, the Trojan encodes data sets collected from the user`s computer in the Base64 format and then sends this to http://www.xx.xx/xx/index.php