Malware

Numando

Numando is a Latin American banking trojan written in Delphi and active since at least 2018. It primarily targets victims in Brazil, with less frequent campaigns against Mexico and Spain. It belongs to the broader cluster of LATAM banking trojans that share overlapping tradecraft, including MSI-based delivery, ZIP-packaged components, DLL side-loading, custom string encryption, and operator-driven fraud using institution-themed overlay windows.

Numando is distributed almost exclusively through spam campaigns. Observed delivery chains commonly use ZIP attachments containing MSI installers. A typical infection deploys a legitimate application, an injector, and an encrypted Numando payload; execution occurs when the legitimate application side-loads the injector, which decrypts and launches the banking trojan. Some campaigns have also used a Delphi downloader that retrieves a decoy archive and extracts an encrypted URL from ZIP metadata to obtain the real payload. In another observed variant, the final payload was concealed inside image overlay data and extracted by the injector at runtime.

The malware is designed for interactive banking fraud rather than fully automated theft. It monitors for targeted activity and displays fake overlay windows intended to trick victims into entering sensitive information. Supported backdoor-style functions include simulating mouse and keyboard input, taking screenshots, terminating browser processes, displaying overlays, and restarting or shutting down the infected system. Numando also collects basic host information, including Windows version and system architecture.

Numando uses numeric command identifiers instead of string-based commands and stores remote configuration data on public services, with configuration entries encrypted using keys embedded in the malware. Variants have stored overlay resources either in encrypted archives embedded in resources or in separate Delphi DLLs. Compared with some higher-volume LATAM banking trojans, Numando appears less prevalent and shows relatively limited evolution over time, but it remains a persistent threat within the regional banking-trojan ecosystem.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

29 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

2 techniques

T1583.001DomainsEvidence1

T1583.001 Acquire Infrastructure: Domains Numando operators register domains to be used as C&C servers.

T1587.001MalwareEvidence1

T1587.001 Develop Capabilities: Malware Numando is likely developed by its operator.

Initial Access

3 techniques

T1566PhishingEvidence2

Numando is distributed almost exclusively by spam... Recent campaigns simply add a ZIP attachment containing an MSI installer to each spammed message.

T1566.001Spearphishing AttachmentEvidence1

T1566.001 Phishing: Spearphishing Attachment ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅

T1566.002Spearphishing LinkEvidence1

T1566.002 Phishing: Spearphishing Link ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ❌ ✅ ✅

Execution

4 techniques

T1047Windows Management InstrumentationEvidence1

T1047 Windows Management Instrumentation ✅ ❌ ❌ ✅ ❌ ❌ ✅ ✅ ✅ ❌ ❌ ❌

T1059.005Visual BasicEvidence1

they heavily rely on scripting languages, mainly VBScript

T1204User ExecutionEvidence1

Potential victims need to follow steps required to install the malware on their machines

T1204.002Malicious FileEvidence1

If the potential victim executes the MSI, it eventually runs the legitimate application as well, and that side-loads the injector.

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Registry Run key or Startup folder are the most common methods of persistence

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Registry Run key or Startup folder are the most common methods of persistence

Stealth

3 techniques

T1027.002Software PackingEvidence1

Some Numando binaries are packed with VMProtect or Themida.

T1140Deobfuscate/Decode Files or InformationEvidence2

The injector locates the payload and then decrypts it using a simple XOR algorithm with a multi-byte key... Numando encrypts its payload or hides it inside a BMP image file, and some variants encrypt and hex encode their main payload URLs in a comment in decoy ZIP files.

T1218.007MsiexecEvidence2

Numando uses the MSI format for execution.

Credential Access

4 techniques

T1056Input CaptureEvidence1

Operators need to react to this situation and manually command the malware to display the fake pop-up window and take control of the victim’s machine

T1056.001KeyloggingEvidence1

to steal credentials, they tend to use either fake pop-up windows or keyloggers

T1056.002GUI Input CaptureEvidence1

to steal credentials, they tend to use either fake pop-up windows or keyloggers

T1555.003Credentials from Web BrowsersEvidence1

T1555.003 Credentials from Password Stores: Credentials from Web Browsers ✅ ✅ ✅ ✅ ❌ ✅ ✅ ✅ ✅ ❌ ❌ ❌

Discovery

5 techniques

T1010Application Window DiscoveryEvidence2

Numando monitors the foreground windows.

T1057Process DiscoveryEvidence1

T1057 Process Discovery ❌ ✅ ✅ ❌ ✅ ✅ ✅ ✅ ✅ ❌ ✅ ❌

T1082System Information DiscoveryEvidence2

Numando collects the victimized machine’s Windows version and bitness.

T1083File and Directory DiscoveryEvidence1

T1083 File and Directory Discovery ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ❌ ❌ ❌

T1518.001Security Software DiscoveryEvidence1

they devote considerable effort to collect screenshots and scan for security software

Collection

5 techniques

T1056Input CaptureEvidence1

Operators need to react to this situation and manually command the malware to display the fake pop-up window and take control of the victim’s machine

T1056.001KeyloggingEvidence1

to steal credentials, they tend to use either fake pop-up windows or keyloggers

T1056.002GUI Input CaptureEvidence1

to steal credentials, they tend to use either fake pop-up windows or keyloggers

T1113Screen CaptureEvidence2

Backdoor capabilities allow Numando to... take screenshots

T1115Clipboard DataEvidence1

T1115 Clipboard Data ✅ ✅ ❌ ❌ ❌ ❌ ✅ ✅ ✅ ❌ ❌ ❌

Command and Control

3 techniques

T1132.002Non-Standard EncodingEvidence2

Strings are encrypted... The format is simple – three entries delimited by “:” between the DATA:{ and } markers. Each entry is encrypted separately... T1132.002 Data Encoding: Non-Standard Encoding Numando uses custom encryption.

T1219Remote Access ToolsEvidence1

Operators need to react to this situation and manually command the malware to display the fake pop-up window and take control of the victim’s machine

T1571Non-Standard PortEvidence1

T1571 Non-Standard Port ✅ ✅ ✅ ❌ ✅ ❌ ✅ ✅ ✅ ❌ ✅ ✅

Exfiltration

2 techniques

T1041Exfiltration Over C2 ChannelEvidence2

T1041 Exfiltration Over C2 Channel Numando exfiltrates data via a C&C server.

T1048Exfiltration Over Alternative ProtocolEvidence1

they do not exfiltrate all harvested data to the C&C server, but use different locations as well

INDICATORS OF COMPROMISE

IOCs tracked for this family

20 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

13 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

7 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app5 years ago

domain●●●●●●●●●●●●View more in app5 years ago

hash.sha1●●●●●●●●●●●●View more in app5 years ago

ip.v4●●●●●●●●●●●●View more in app5 years ago

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

eset welivesecurity blogNews

Dec 15, 2021

The dirty dozen of Latin America: From Amavaldo to Zumanek

Latin American banking trojan family included among the active families tracked by ESET in this series.

eset welivesecurity blogNews

Sep 17, 2021

Numando: Count once, code twice

A Latin American banking trojan written in Delphi that primarily targets Brazilian victims using spam-delivered MSI installers, DLL side-loading, fake overlay windows, and backdoor capabilities including simulated mouse/keyboard actions, screenshots, browser process termination, and system restart/shutdown. It also abuses YouTube and Pastebin for remote configuration storage and has used decoy ZIP archives and BMP overlays to conceal payload delivery.

eset welivesecurity blogNews

Oct 1, 2020

LATAM financial cybercrime: Competitors-in-crime sharing TTPs

Latin American banking trojan family discussed as part of a broader ecosystem of cooperating banking malware operators.

eset assetsNews

May 26, 2026

Latin American banking trojan that follows the shared regional banking-trojan architecture and uses fake pop-up windows for credential theft. It shares a custom string-encryption scheme with several other families and has used DLL side-loading.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching20

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping29

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Numando