MalwareUsed by 1 actor

Tcl.Agent

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

REF3076

Tcl.Agent is a banking trojan, the main component of the chain.

via elastic security labselastic.co

MITRE ATT&CK

Techniques & procedures

18 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1053.005Scheduled TaskEvidence2

It creates a scheduled task named RuntimeOptimizeService with a logon trigger scoped to the current user.

T1059.003Windows Command ShellEvidence2

Opcode 67 provides shell command execution through cmd.exe /c; the updater also launches a self-deleting batch script through hidden cmd.exe.

Persistence

1 technique

T1053.005Scheduled TaskEvidence2

It creates a scheduled task named RuntimeOptimizeService with a logon trigger scoped to the current user.

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence2

It creates a scheduled task named RuntimeOptimizeService with a logon trigger scoped to the current user.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence2

The loader implements string encryption and encrypted payloads, while Tcl.Agent and Tcl.WppBot are protected with .NET Reactor.

T1218.007MsiexecEvidence2

The self-update batch script executes msiexec /i /qn REINSTALLMODE=amus for silent installation.

Credential Access

2 techniques

T1056.001KeyloggingEvidence2

Opcode 39 starts a keylogger using a WH_KEYBOARD_LL hook, and opcode 40 flushes captured keystrokes to C2.

T1056.003Web Portal CaptureEvidence2

The WPF credential-prompt overlay collects phone, PIN, or text values, and the submit action sends captured values to C2.

Discovery

4 techniques

T1010Application Window DiscoveryEvidence2

The watchdog uses GetWindowTextW() and FindWindowW() to identify analyst tool titles and window classes; opcode 80 enumerates visible windows.

T1057Process DiscoveryEvidence2

The watchdog performs process enumeration via CreateToolhelp32Snapshot() and searches for analysis-tool process names; opcode 65 retrieves running-process information.

T1082System Information DiscoveryEvidence2

The environment checks retrieve system disk, memory, CPU, username, geographic, and locale information; the initial beacon includes machine name and OS version.

T1614.001System Language DiscoveryEvidence2

TCLBANKER uses GetUserGeoID() and GetUserDefaultLCID() to require Brazilian geography and Brazilian Portuguese; Tcl.Agent requires at least two Brazil-related region, timezone, LCID, or keyboard indicators.

Collection

4 techniques

T1056.001KeyloggingEvidence2

Opcode 39 starts a keylogger using a WH_KEYBOARD_LL hook, and opcode 40 flushes captured keystrokes to C2.

T1056.003Web Portal CaptureEvidence2

The WPF credential-prompt overlay collects phone, PIN, or text values, and the submit action sends captured values to C2.

T1113Screen CaptureEvidence2

C2 opcodes support screenshots and screen streaming; overlay initialization captures each display using CopyFromScreen.

T1115Clipboard DataEvidence2

Opcode 41 performs clipboard hijack using Clipboard.SetText.

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence2

When a victim opens a monitored banking domain, the agent establishes a WebSocket connection to wss://mxtestacionamentos[.]com/ws; campaign APIs use HTTPS endpoints.

T1102Web ServiceEvidence2

All C2, update, campaign, and distribution infrastructure is hosted on Cloudflare Workers under a single account.

T1105Ingress Tool TransferEvidence2

On a version-hash mismatch, the agent downloads an updated MSI from the documents.ef971a42.workers[.]dev/api/update endpoint.

Impact

1 technique

T1529System Shutdown/RebootEvidence2

C2 opcode 6 triggers a forced reboot using shutdown.exe /r /t 0 /f.

Other

2 techniques

T1562Impair DefensesEvidence1

After installing syscall stubs, the malware patches EtwEventWrite in ntdll.dll with the classic xor eax, eax; ret to disable user-mode ETW telemetry.

T1562.001Disable or Modify ToolsEvidence1

The loader replaces ntdll.dll from disk to remove user-mode hooks and patches EtwEventWrite with xor eax, eax; ret to disable user-mode ETW telemetry.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

elastic security labsNews

May 7, 2026

TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook

The primary .NET Reactor-protected banking module of TCLBANKER. It geofences for Brazilian systems, establishes scheduled-task persistence, monitors browser address bars for targeted financial and cryptocurrency domains, and initiates WebSocket C2 sessions for remote control and social-engineering overlays.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping18

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

Tcl.Agent

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

REF3076

Tcl.Agent is a banking trojan, the main component of the chain.

via elastic security labselastic.co

MITRE ATT&CK

Techniques & procedures

18 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1053.005Scheduled TaskEvidence2

It creates a scheduled task named RuntimeOptimizeService with a logon trigger scoped to the current user.

T1059.003Windows Command ShellEvidence2

Opcode 67 provides shell command execution through cmd.exe /c; the updater also launches a self-deleting batch script through hidden cmd.exe.

Persistence

1 technique

T1053.005Scheduled TaskEvidence2

It creates a scheduled task named RuntimeOptimizeService with a logon trigger scoped to the current user.

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence2

It creates a scheduled task named RuntimeOptimizeService with a logon trigger scoped to the current user.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence2

The loader implements string encryption and encrypted payloads, while Tcl.Agent and Tcl.WppBot are protected with .NET Reactor.

T1218.007MsiexecEvidence2

The self-update batch script executes msiexec /i /qn REINSTALLMODE=amus for silent installation.

Credential Access

2 techniques

T1056.001KeyloggingEvidence2

Opcode 39 starts a keylogger using a WH_KEYBOARD_LL hook, and opcode 40 flushes captured keystrokes to C2.

T1056.003Web Portal CaptureEvidence2

The WPF credential-prompt overlay collects phone, PIN, or text values, and the submit action sends captured values to C2.

Discovery

4 techniques

T1010Application Window DiscoveryEvidence2

The watchdog uses GetWindowTextW() and FindWindowW() to identify analyst tool titles and window classes; opcode 80 enumerates visible windows.

T1057Process DiscoveryEvidence2

The watchdog performs process enumeration via CreateToolhelp32Snapshot() and searches for analysis-tool process names; opcode 65 retrieves running-process information.

T1082System Information DiscoveryEvidence2

The environment checks retrieve system disk, memory, CPU, username, geographic, and locale information; the initial beacon includes machine name and OS version.

T1614.001System Language DiscoveryEvidence2

Collection

4 techniques

T1056.001KeyloggingEvidence2

Opcode 39 starts a keylogger using a WH_KEYBOARD_LL hook, and opcode 40 flushes captured keystrokes to C2.

T1056.003Web Portal CaptureEvidence2

The WPF credential-prompt overlay collects phone, PIN, or text values, and the submit action sends captured values to C2.

T1113Screen CaptureEvidence2

C2 opcodes support screenshots and screen streaming; overlay initialization captures each display using CopyFromScreen.

T1115Clipboard DataEvidence2

Opcode 41 performs clipboard hijack using Clipboard.SetText.

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence2

When a victim opens a monitored banking domain, the agent establishes a WebSocket connection to wss://mxtestacionamentos[.]com/ws; campaign APIs use HTTPS endpoints.

T1102Web ServiceEvidence2

All C2, update, campaign, and distribution infrastructure is hosted on Cloudflare Workers under a single account.

T1105Ingress Tool TransferEvidence2

On a version-hash mismatch, the agent downloads an updated MSI from the documents.ef971a42.workers[.]dev/api/update endpoint.

Impact

1 technique

T1529System Shutdown/RebootEvidence2

C2 opcode 6 triggers a forced reboot using shutdown.exe /r /t 0 /f.

Other

2 techniques

T1562Impair DefensesEvidence1

After installing syscall stubs, the malware patches EtwEventWrite in ntdll.dll with the classic xor eax, eax; ret to disable user-mode ETW telemetry.

T1562.001Disable or Modify ToolsEvidence1

The loader replaces ntdll.dll from disk to remove user-mode hooks and patches EtwEventWrite with xor eax, eax; ret to disable user-mode ETW telemetry.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

elastic security labsNews

May 7, 2026

TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping18

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.