The Trojan monitors HTTP requests for certain banking sites and steals login The Trojan captures login data for the following domains: . www.e-credit.ad.