Slave, Banatrix and ransomware

This report analyzes the 'Slave' Polish e-banking trojan (dropped by Andromeda), describing its email-based delivery, webinject-driven credential theft across Internet Explorer, Firefox and Chrome, stripping of CSP headers to evade bank reporting, Bitcoin-address clipboard hijacking, configuration retrieval behavior, provided sample hashes/VT scores, and likely ties to authors of earlier Polish malware such as Banatrix.