Loading malware…
Malteiro is malware associated with the Mispadu infection chain. The provided content states that it will terminate Mispadu’s infection process if the victim machine language is not Spanish or Portuguese, indicating targeting focused on Spanish- and Portuguese-language systems. The content also states that Malteiro collects information about the antivirus installed on the victim machine, showing defensive discovery behavior prior to or during execution. No additional high-confidence details on infection vector, platform beyond the implied victim machine context, specific industries, threat actor attribution, or indicators of compromise are provided in the source content.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct techniques documented for this family, organized by ATT&CK tactic.
"Agent Tesla can gather credentials from a number of browsers." / "...custom-developed malware, which collected passwords from the Firefox browser storage." / "...used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores."
The content repeatedly describes malware and threat actors collecting host details such as OS version, hostname, architecture, CPU/RAM, BIOS, domain role, and other configuration data (e.g., “uses multiple built-in commands such as systeminfo and net config Workstation to enumerate victim system basic configuration information.”).
Multiple malware families (e.g., Avaddon, Bazar, Clop, Ryuk, REvil, LockBit, Zeus Panda) check OS language/keyboard layout/locale and terminate or alter execution if the system matches excluded languages (commonly Russian/CIS) or does not match desired target languages (e.g., Spanish/Portuguese, Arabic, Persian).
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Collects information about installed antivirus on victim machines.
Malware that enforces Spanish/Portuguese locale targeting and can terminate another malware's infection flow if locale mismatches.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.