Loading malware…
Eternidade Stealer is a Brazil-focused Delphi-based banking trojan and credential-stealing malware family used in financially motivated campaigns that abuse WhatsApp for distribution and propagation. It has been observed in a multi-stage infection chain that uses social engineering lures, an obfuscated VBScript downloader, an MSI-based installer path, AutoIt-based staging, and a Python component that hijacks WhatsApp Web sessions to harvest contacts and spread malicious attachments in a worm-like manner. The malware is explicitly localized for Brazilian victims and commonly aborts unless the operating system language is set to Brazilian Portuguese.
Once deployed, Eternidade Stealer profiles the infected host, enumerates security products, inspects running processes and active windows, and identifies banking, payment, and cryptocurrency applications or portals of interest. It targets Brazilian financial institutions as well as payment services and cryptocurrency exchanges and wallets. The malware is associated with credential theft through active-window monitoring and spoofed or hidden banking overlays designed to capture victim input. Reported command support and related functionality indicate broader surveillance and host-control features, including active-window reporting, file transfer, screenshot or image capture, and keylogging-related behavior.
A notable characteristic is its use of IMAP over SSL to dynamically retrieve updated command-and-control infrastructure from an email account, with fallback hardcoded infrastructure if retrieval fails. Later stages have been observed using in-memory loading and process hollowing into a legitimate Windows process for defense evasion. Code and routine similarities to other Brazilian banking malware, including Astaroth and tooling patterns seen alongside Casbaneiro-related tradecraft, suggest continuity with the Brazilian banking trojan ecosystem, although direct lineage should be treated cautiously.
The broader campaign around Eternidade Stealer has been linked to Brazilian threat actors and combines financial theft, WhatsApp contact theft, automated propagation, geofenced targeting, and layered evasion. Victim targeting has centered on Brazilian bank customers and users of regional fintech and cryptocurrency services, with desktop Windows systems the primary observed platform.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"...a Delphi-based banking trojan named Eternidade Stealer..."; "A Delphi-based credential stealer, Eternidade continuously scans active windows and running processes for strings related to banking portals, payment services, and cryptocurrency exchanges and wallets..."
39 distinct techniques documented for this family, organized by ATT&CK tactic.
Previous campaigns observed through 2024 and 2025... show a clear evolution from simple phishing links to complex social engineering schemes involving fake government programs, delivery notifications, and even fraudulent investment groups shared through WhatsApp messages and groups.
When executed, the script drops a batch file that downloads and executes payloads
The campaign begins via an obfuscated VBScript, with most of its comments written in Portuguese.
The WhatsApp worm used in the campaign is written in Python... The dropper also installs the necessary Python dependencies for the payloads to run successfully.
The decrypted .tda file is a Delphi-compiled injector that performs process hollowing to run the final payload.
The injector reads the .dmp file, decrypts it using the same routine mentioned above, and injects the Eternidade Stealer payload to svchost.exe.
If found, it first loads the .tda file, decrypts it using a custom stream cipher, and is decompressed using LZNT1 before running it in memory.
executando-o por meio do msiexec.exe... msiexec.exe /i instalador.msi /qn /norestart
Such a behavior reflects a classic banker or overlay-stealer tactic, where malicious components lie dormant until the victim opens a targeted banking or wallet application, ensuring the attack triggers only in relevant contexts and remains invisible to casual users or sandbox environments.
It then enumerates all windows via the “EnumWindows” API, collects the following attributes... Window Title, Class Name, Executable Path.
It first queries the Windows registry to retrieve the operating system’s product name, then collects the processor model from the hardware description keys. | When executed, it first checks for the Registry key “HKEY_CURRENT_USER\Software\MeuApp”... It then proceeds to create the Registry key "MeuApp” and set the value of “Inicio” to True.
It contains functions that gather system telemetry, the external IP via an api.ipify.org call, and local IP collection
Gathered information: Computer name OS version and build Username
The script enumerates running processes... The sample demonstrates a clear and highly localized targeting logic. It continuously scans active windows and running processes for strings associated with Brazilian banking portals
It contains functions that gather system telemetry, the external IP via an api.ipify.org call, and local IP collection... The malware then sends the collected system information via POST method to its C2
The malware searches for .tda or .dmp files in the installation folder
Such a behavior reflects a classic banker or overlay-stealer tactic, where malicious components lie dormant until the victim opens a targeted banking or wallet application, ensuring the attack triggers only in relevant contexts and remains invisible to casual users or sandbox environments.
The malware only targets Brazilian victims by checking the OS language. If the system is not detected as Brazilian Portuguese, it displays an error message and aborts execution.
If the malware cannot connect to the email account, it uses a hardcoded fallback C2 address.
It uses Internet Message Access Protocol (IMAP) to dynamically retrieve command-and-control (C2) addresses
há três principais objetivos... enviar para um servidor... hxxps[:]//013net[.]com[.]br/jasmin/receptor[.]php... Durante sua execução o WhatsWorm envia logs para o servidor de C&C... /api/log.php
47 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Delphi-based banking trojan/stealer distributed via WhatsApp hijacking/social engineering; uses IMAP to retrieve C2 addresses dynamically; targets Brazil.
Infostealer delivered via a multi-stage chain abusing WhatsApp; uses scripts (VBScript/PowerShell) and a Python component to propagate via hijacked WhatsApp accounts, then installs via MSI to steal banking, payment, and cryptocurrency credentials.
Information stealer distributed via WhatsApp-based social engineering to compromise financial and cryptocurrency accounts.
A Delphi-based credential stealer delivered in a WhatsApp abuse campaign via a malicious MSI installer. It monitors active windows and running processes for banking, payment, and cryptocurrency-related strings to steal credentials and access to financial and crypto accounts.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.