Grandoreiro

Their developers often distribute samples via phishing emails, sometimes casting a wide net and other times targeting specific individuals. These emails often masquerade as official correspondence related to tax or compliance matters, and occasionally attempt to impersonate government or tax agencies themselves.

In early 2022 campaigns, the malicious email included an attached PDF. As soon as the PDF is opened, the victim is prompted with a blurred image... When the victim clicks the button, they are redirected to a malicious web page which prompts them to download a ZIP file.

Then, a couple of links — all pointing to the same URL — are provided. Let’s explore them.

In 2022, a Grandoreiro variant was observed leveraging enhanced detection evasion techniques and had several new features: keylogging, automatically applying updates to itself, web injection, command execution...

A closer inspection reveals a rather simple but effective trick: a JavaScript redirection.

Inside the zip file... there was an EXE file, just like the good old times, accompanied by an “XML” file which was actually another executable.

Sandworm Team leveraged Microsoft Office attachments which contained malicious macros that were automatically executed once the user permitted them... APT29 has used various forms of spearphishing attempting to get a user to open attachments... DarkGate is distributed through phishing links to VBS or MSI objects requiring user interaction for execution.

During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].

Numerous malware families and threat groups are described as achieving persistence by adding values under Run/RunOnce/Policies\Explorer\Run Registry keys or by placing shortcuts/files in the Windows Startup folder.

Numerous malware families and threat groups are described as achieving persistence by adding values under Run/RunOnce/Policies\Explorer\Run Registry keys or by placing shortcuts/files in the Windows Startup folder.

This growth is likely due to an artificial pattern that can be easily compressed for distribution, but expands upon decompression, potentially discouraging antivirus programs from scanning the file due to its size.

Grandoreiro utilizes a binary padding technique to inflate the size of the malicious files as a way to evade sandboxes.

the original sender is not “gob.mx” but rather someone else’s website... These emails often masquerade as official correspondence related to tax or compliance matters, and occasionally attempt to impersonate government or tax agencies themselves.

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

using legitimate binaries that are digitally signed to run the malware.

The website says: “The content is not available on mobile devices. Please access it on a COMPUTER.” ... After changing the User-Agent header ... I was automatically being redirected to Google... after changing my VPN node and the User-Agent header once again to simulate Firefox on Windows, I was able to proceed with the infection chain.

The malware also uses the IsDebuggerPresent() function to determine whether the current process is being executed in the context of a debugger.

During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].

present a custom image (overlay) to ask the victim for extra information. These are usually OTPs (one-time passwords), transaction passwords or tokens received by SMS

In 2022, a Grandoreiro variant was observed leveraging enhanced detection evasion techniques and had several new features: keylogging... In 2024, Casabaneiro (Mekotio) was observed targeting financial systems... displaying the capabilities to produce fake banking pop-ups to capture banking credentials, capture screenshots, log keystrokes, and access clipboard data.

the malware is capturing user input patterns, particularly mouse movements... “Record for 5 seconds the client’s average mouse speed”

Grandoreiro has capabilities to both steal data through keyloggers and screen-grabbers as well as steal bank login information from overlays when an infected victim visits pre-determined banking sites targeted by the threat actors.

In 2022, a Grandoreiro variant was observed leveraging enhanced detection evasion techniques and had several new features: keylogging, automatically applying updates to itself, web injection, command execution...

The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.

The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking whether the current user is an administrator, enumerating user sessions, and gathering account details from compromised hosts.

The malware takes a snapshot of currently executing processes in the system using the CreateToolhelp32Snapshot() Windows API and goes through the process list using Process32FirstW() and Process32NextW().

The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.

The website says: “The content is not available on mobile devices. Please access it on a COMPUTER.” ... After changing the User-Agent header ... I was automatically being redirected to Google... after changing my VPN node and the User-Agent header once again to simulate Firefox on Windows, I was able to proceed with the infection chain.

some Grandoreiro samples check whether the following programs are installed: CHROME.EXE; MSEDGE.EXE; FIREFOX.EXE; IEXPLORE.EXE; OUTLOOK.EXE... VeraCrypt; Nortonvpn; Adobe; OneDrive; Dropbox.

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.

One of these tasks is the use of the geolocation service http://ip-api.com/json to gather the target’s IP address location data.

The function will do nothing if the system language is English, but otherwise the final payload is downloaded.

The malware also uses the IsDebuggerPresent() function to determine whether the current process is being executed in the context of a debugger.

present a custom image (overlay) to ask the victim for extra information. These are usually OTPs (one-time passwords), transaction passwords or tokens received by SMS

In 2022, a Grandoreiro variant was observed leveraging enhanced detection evasion techniques and had several new features: keylogging... In 2024, Casabaneiro (Mekotio) was observed targeting financial systems... displaying the capabilities to produce fake banking pop-ups to capture banking credentials, capture screenshots, log keystrokes, and access clipboard data.

the malware is capturing user input patterns, particularly mouse movements... “Record for 5 seconds the client’s average mouse speed”

Grandoreiro has capabilities to both steal data through keyloggers and screen-grabbers as well as steal bank login information from overlays when an infected victim visits pre-determined banking sites targeted by the threat actors.

In 2022, a Grandoreiro variant was observed leveraging enhanced detection evasion techniques and had several new features: keylogging, automatically applying updates to itself, web injection, command execution...

Operators behind Grandoreiro are equipped with a wide variety of remote commands, including an option to lock the user screen and present a custom image (overlay) to ask the victim for extra information.

These are some RAT features that we found in this version: ... Monitoring Outlook emails for specific keywords

Agent Tesla can steal data from the victim’s clipboard. APT38 used a Trojan called KEYLIME to collect data from the clipboard. APT39 has used tools capable of stealing contents of the clipboard.

the malware sample started downloading immediately, compressed as a 1.7MB zip file named “ IMPUES_TOTRIB-UTZMHYfcpyLUGCCHYMPLAG.zip ”.

The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."

The loader will then download and run the final Grandoreiro payload and check in with a command and control (C2) server.

The newest Grandoreiro version uses 3 Domain Generation Algorithms (DGAs), generating valid domains for command and control (C2) communications.

In 2022, a Grandoreiro variant was observed leveraging enhanced detection evasion techniques and had several new features... and generation of C2 domains via a domain generation algorithm (DGA).

ComRAT has modified Registry values to store encrypted orchestrator code and payloads ... QakBot can modify the Registry to store its configuration information ... Volgmer modifies the Registry to store an encoded configuration file ...