28 Apr 2020 - 11:30AM . Another in our occasional series demystifying Latin American banking trojans . In this installment of our series, we introduce Grandoreiro, a Latin American banking trojan targeting Brazil, Mexico, Spain and Peru. The authors of Grandoreiro seem to be developing the banking trojan very rapidly, as we observe at least several new versions each month. The spam emails appear to contain a link pointing to a website offering fake Flash or Java updates (see Figure 5). Notice the red arrow in lower left corner tailored for the Google Chrome web browser, but displayed in other browsers too. The images shown in Figure 10 come from three different builds of Grandoreiro. Self-protection & anti-emulation . For a Latin American banking trojan, Grandoreiro utilizes a surprisingly large number of tricks to evade detection and emulation. Diebold Warsaw GAS Tecnologia and Trusteer are known banking access protection software popular in Latin America. Simple BAT script used by Grandoreiro to change Trusteer file path in hopes of making it unable to execute . Besides that, it also monitors hooks on important functions. List of configuration files used by Grandoreiro’s spam tool . As you can see, the tool is not fully automated, but relies completely on the configuration data. Its implementation shows similarities with the Grandoreiro banking trojan, which is why we believe it was written by the same authors. Indicators of Compromise (IoCs) . Hashes . Grandoreiro banking trojan . Grandoreiro Win32 downloaders . Grandoreiro spam tool . Windows Registry . - HKCU\Software\%USER_NAME% - HKCU\Software\ToolTech-RM User-Agent . - h55u4u4u5uii5 Filenames . - - MDL_YEL_01.dll - MDL_BLU_BR_02.dll - MDL_SIC_BR_03.dll - MDL_SANT_BR_04.dll - MDL_ITA_BR_05.dll - MDL_BRADA_BR_06.dll - MDL_SICCB_BR_07.dll - MDL_SAFRA_BR_08.dll - MDL_ORIGI_BR_09.dll - MDL_NORDES_BR_10.dll - MDL_BANEST_BR_11.dll - MDL_BANEZE_BR_12.dll - MDL_AMAZON_BR_13.dll - MDL_UNICRE_BR_14.dll - MDL_BRB_BR_15.dll - MDL_WUPDATE_BR_001.dll * %INSTALL_DIR% is the path where Grandoreiro is installed . MITRE ATT&CK techniques . Further reading . 28 Apr 2020 - 11:30AM . Sign up to receive an email update whenever a new article is published in our Ukraine Crisis – Digital Security Resource Center . Newsletter . Similar Articles . How Emotet is changing tactics in response to Microsoft’s tightening of Office macro security . ESET Research . Watering hole deploys new macOS malware, DazzleSpy, in Asia . Virus Bulletin: Old malware never dies – it just gets more targeted . Anatomy of native IIS malware . Discussion . - Home - About Us - Contact Us - Sitemap - Our Experts - ESET - Research - How To - Categories - RSS Configurator - News Widget