I've been seeing an increasing number of infections by this trojan.
It seems to monitor Chrome, Firefox, Safari and IE to steal bank account informations.
In case anyone's interested in analyzing it, I'll post it here.

Passsword: malware

Not Opera ? \0/

EDIT:Wow it is quite nasty... It is detected as Trojan.Win32.Cosmu.faz by KAV, it's in watch list since two days.

Your file is packed with UPX, it contains 18 imports and numerous functions, analysis made the debugger crap its pants and my VM to BSOD..
There is a resident binary called "services" which is also running a child called "jqs", the latter one is dropped in Local Settings\Temp, the first one is detected, not the latter one.
It is dropping some files on system32 and all...

It is querying google.com.br, then happymod.info
On this one it is GETting four files "flexds10.a,house10.a,total10.pmk,view25.a" which are XORed binaries, also packed with UPX. They all seem to contain the same code.

It also query contabilizando.webcindario.com/acesso.php with information about your infected computer (windows version, user name, ip address and port). This PHP code is exploitable btw.

Some anon example from the root dir list:



EDIT2:http://www.threatexpert.com/report.aspx?md5=2acca2a8316782af9d0892e679f7594a some additionnal infos for you guys.

This is a courtesy of Brasil =)


Thanks to MAD° guys for the side by side analysis

° http://mad.internetpol.fr/ - [FR]

A variant described on Trend Micro's blog.
http://blog.trendmicro.com/banker-scams-new-spam-victims/