AllaSenha

AllaSenha is a Brazilian banking trojan/RAT in the AllaKore ecosystem, described as a custom variant likely based on KL Gorki code and assessed in later reporting as part of the AllaSenha/CarnavalHeist lineage from which NFe-RAT directly evolved. It is focused on stealing credentials for Brazilian bank accounts, including passwords and 2FA artifacts such as tokens and QR codes, and uses operator-driven overlays and RAT functionality to hijack authentication flows. Reported targets include Brazilian financial institutions such as Banco do Brasil, Itaú Unibanco, Bradesco, Santander, Banco Safra, Sicredi, Sicoob, Unicred, Banrisul, and Caixa Econômica Federal.

Observed delivery used phishing emails impersonating Brazilian electronic invoice notifications (NFS-e / Nota Fiscal), including fake nota fiscal sites reached via is[.]gd short links and domains such as nfe-digital[.]digital, nfe-digital[.]top, nfe-pdf[.]shop, and notas-pdf[.]shop. The infection chain abused the Windows search/search-ms protocol and WebDAV to present a remote share containing a malicious LNK such as NotaFiscal.pdf.lnk or NF410296447634.pdf.lnk. The LNK created a decoy PDF and launched a BAT/PowerShell stage that downloaded the official embedded Python distribution from python.org, renamed pythonw.exe, and executed a base64-encoded Python stager entirely in memory.

The Python stage, referred to as BPyCode/CodePy in reporting, used a DGA to generate daily C2 targets and communicated over raw TCP, sending beacon strings such as "pyCodeV10 - NEWW" or "pyCodeV1 - {hostname}|{os_version}|{cpu_name}". It retrieved serialized loader content and encrypted ZIP payloads, established persistence by writing a stager to disk and creating an HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry value, and then loaded a Delphi DLL loader in memory. The loader, identified as ExecutorLoader/executor.dll and exporting Force, copied or renamed mshta.exe, launched it, and reflectively injected the final Delphi payload into that process without writing the PE to disk. Samples were reported as UPX-packed 32-bit Delphi DLLs.

AllaSenha uses Azure-hosted infrastructure for command and control, including daily-rotated hostnames under *.brazilsouth.cloudapp.azure[.]com in 2024 reporting and later Azure Brazil South relay infrastructure in 2026 reporting. C2 uses raw ASCII/TCP with command delimiters formatted as <|COMMAND|>. Reported capabilities include credential theft, capture of PIX-related QR codes for instant-payment fraud, keyboard and mouse control, remote desktop/screen interaction, keylogging, screen capture, and anti-support behavior such as the <|FECHAR-ANYDESK|> command to terminate AnyDesk. The malware and associated loaders also included a Broadwell CPU string check as an anti-analysis measure.

High-confidence indicators mentioned in the content include infrastructure and artifacts such as 191.232.38[.]222:80, 20.195.216.43, 189.37.69.81, the phishing domains above, the password Snh2301Snh2301 used for ZIP archives and reused operationally, the internal DLL name Access_PC_Client_dll.dll, and hashes including ExecutorLoader SHA-256 99d0de52a63e5ff790e468dbb8cd0d5273b51ca3b67b5963c0bdedc3a4f44f12, packed AllaSenha SHA-256 65d86160cd4a08d60ada7fcafb7ed9493bf6dacfa098dba27f7851f1bb8de841, and unpacked AllaSenha SHA-256 ac4b4b6cfe4d4e8710384246c008764cdb7547a6c3081e72687fefdf0614c7a5. Attribution to a specific known threat actor was not established in the cited reporting, though artifacts referenced usernames such as bert1m, xxb3xx, and maria and a Portuguese-language/Brazilian operating context.