The Grandoreiro banking trojan is malware written in Delphi that steals banking credentials and watches online banking sessions. MITRE ATT&CK records it as first observed in 2016 and as targeting financial sector victims in Brazil, Mexico, Portugal and Spain. In January 2024, Brazilian authorities arrested five administrators of the operation, according to INTERPOL.
What Is the Grandoreiro Banking Trojan?
Grandoreiro, a sophisticated banking trojan, targets organizations across various industry verticals in the Spanish-speaking nations of Mexico and Spain. This malware has been active since at least 2016 and focuses explicitly on users in Latin America, posing a significant threat to their financial security. Written in Delphi, Grandoreiro has been meticulously designed to infiltrate and exploit banking systems in these regions.
What You Will Find In This Report?
Learn Technical Method of Operation Details
You will find the technical details of the Grandoreiro Trojan its functions, and details about cyber attack tactics. The report will show many points about its technical details, detections, and IoCs.
Gain Knowledge About Future Attacks
By understanding its attack model, you can make more informed predictions about the future of cybersecurity. Stay up-to-date with the latest trends and keep your business from potential threats.
Response & Mitigation Tactics From Experts
Brandefense analysts share practical response and mitigation advice on this topic. The Grandoreiro Trojan employs sophisticated techniques to avoid analysis by security researchers. You need experts’ perspective.
What Does the Grandoreiro Trojan Technical Analysis Report Cover?
The report is a technical write-up of one Grandoreiro sample. It is split into an executive summary, scope, technical analysis, indicators of compromise, a YARA rule, a MITRE ATT&CK matrix, mitigation strategies and a conclusion.
Key Technical Findings
- The sample arrives as a small set of files. The report says HostFx.exe is a harmless program used to run the malicious payload, which is a DLL named zlibai.dll.
- For persistence, the report says the malware adds a key named fujajomui under the current user Run registry path.
- The report says Grandoreiro can capture clipboard data from compromised hosts.
- To avoid analysis, the loader waits for user mouse input to spot a virtual machine. It also checks for debuggers, disassemblers, network monitoring and anti-malware software.
- The payload holds a decrypted list of bank and financial service names. The report says the malware also checks the application versions of these institutions.
- For command and control, the malware sends a GET request to an IP lookup service to learn where the system is. It then uses a domain generation algorithm based on the current date.
Detection and Defense
The report lists two sample hashes and example generated domains as indicators of compromise. It includes a YARA rule for detection. Its ATT&CK matrix covers the Initial Access, Execution, Defense Evasion, Discovery and Collection tactics.
Its mitigation advice is short. Check file hashes for files that carry the names of system tools. Be careful with executables that use the icons of legitimate programs. Check the registry for suspicious entries or changes.