Malware

Amavaldo

Amavaldo is a distinct Latin American banking trojan family associated with the Brazilian banking-malware ecosystem. It has been identified as one of at least 11 separate but closely related families that share code patterns, distribution logic, execution techniques, and operator tradecraft while remaining operationally distinct. Amavaldo primarily targets Windows systems and follows the characteristic regional banking-trojan model of monitoring active windows for targeted financial institutions and using institution-themed fake pop-up workflows to steal sensitive information during live operator-assisted fraud.

The family is strongly linked to the broader cluster that includes Casbaneiro, Grandoreiro, Mekotio, Mispadu, Guildma, Numando, and Vadokrist. Across this ecosystem, Amavaldo shares uncommon string-encryption approaches, similar distribution components, and overlapping execution methods. Amavaldo is specifically noted as using communication protocols based on the Delphi Remote Access PC component and as employing DLL side-loading combined with an injector DLL. Code similarities have also been observed between the Amavaldo injector and other malware, including custom stream-cipher routines and PowerShell-based distribution elements reused by related families.

Like other Latin American banking trojans, Amavaldo has been associated with phishing-led delivery chains that commonly rely on spam campaigns, ZIP archives, MSI installers, scripting languages, and staged payload retrieval. These families frequently establish persistence through Run-key or Startup-folder mechanisms and use obfuscation and custom cryptography to hinder analysis and detection. Shared ecosystem behaviors include screenshot capture, active-window scanning, anti-protection measures against banking-security software, and manual attacker interaction during credential theft.

Amavaldo was active during the main period of expansion of Latin American banking trojans and was among the families observed as part of the region’s coordinated-looking evolution and code-sharing culture. It was later assessed as becoming dormant around November 2020. Despite dormancy, Amavaldo remains significant as a representative family in the Latin American banking-trojan landscape because of its technical overlap with multiple other families and its role in illustrating cooperation among separate financially motivated threat actors.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

30 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques

T1566PhishingEvidence1

The campaigns we see always come in waves and more than 90% of them are distributed through spam.

T1566.001Spearphishing AttachmentEvidence1

T1566.001 Phishing: Spearphishing Attachment ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅

T1566.002Spearphishing LinkEvidence1

T1566.002 Phishing: Spearphishing Link ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ❌ ✅ ✅

Execution

6 techniques

T1047Windows Management InstrumentationEvidence1

T1047 Windows Management Instrumentation ✅ ❌ ❌ ✅ ❌ ❌ ✅ ✅ ✅ ❌ ❌ ❌

T1053.005Scheduled TaskEvidence1

T1053.005 Scheduled Task/Job: Scheduled Task ✅ ✅ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌

T1059.001PowerShellEvidence1

T1059.001 Command and Scripting Interpreter: PowerShell ✅ ✅ ❌ ❌ ❌ ❌ ✅ ✅ ❌ ✅ ✅ ❌

T1059.005Visual BasicEvidence1

they heavily rely on scripting languages, mainly VBScript

T1059.007JavaScriptEvidence1

T1059.007 Command and Scripting Interpreter: JavaScript/JScript ✅ ✅ ❌ ✅ ❌ ❌ ✅ ✅ ❌ ✅ ✅ ✅

T1204User ExecutionEvidence1

Potential victims need to follow steps required to install the malware on their machines

Persistence

3 techniques

T1053.005Scheduled TaskEvidence1

T1053.005 Scheduled Task/Job: Scheduled Task ✅ ✅ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌

T1112Modify RegistryEvidence1

T1112 Modify Registry ✅ ✅ ✅ ✅ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌

T1547.001Registry Run Keys / Startup FolderEvidence1

Registry Run key or Startup folder are the most common methods of persistence

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

T1053.005 Scheduled Task/Job: Scheduled Task ✅ ✅ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌

T1547.001Registry Run Keys / Startup FolderEvidence1

Registry Run key or Startup folder are the most common methods of persistence

Stealth

4 techniques

T1140Deobfuscate/Decode Files or InformationEvidence1

they all obfuscate either payloads or configuration data in some way

T1218.007MsiexecEvidence1

since 2019, the vast majority of these malware families started to utilize Windows Installer (MSI files) as the first stage of the distribution chain

T1220XSL Script ProcessingEvidence1

T1220 XSL Script Processing ✅ ❌ ❌ ✅ ❌ ❌ ✅ ❌ ❌ ❌ ❌ ❌

T1497.001System ChecksEvidence1

T1497.001 Virtualization/Sandbox Evasion: System Checks ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ❌ ❌ ❌ ❌

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

T1112 Modify Registry ✅ ✅ ✅ ✅ ❌ ❌ ❌ ❌ ❌ ❌ ❌ ❌

Credential Access

4 techniques

T1056Input CaptureEvidence1

Operators need to react to this situation and manually command the malware to display the fake pop-up window and take control of the victim’s machine

T1056.001KeyloggingEvidence1

to steal credentials, they tend to use either fake pop-up windows or keyloggers

T1056.002GUI Input CaptureEvidence1

to steal credentials, they tend to use either fake pop-up windows or keyloggers

T1555.003Credentials from Web BrowsersEvidence1

T1555.003 Credentials from Password Stores: Credentials from Web Browsers ✅ ✅ ✅ ✅ ❌ ✅ ✅ ✅ ✅ ❌ ❌ ❌

Discovery

5 techniques

T1010Application Window DiscoveryEvidence1

periodically scanning active windows based on name or title

T1082System Information DiscoveryEvidence1

T1082 System Information Discovery ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅

T1083File and Directory DiscoveryEvidence1

T1083 File and Directory Discovery ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ❌ ❌ ❌

T1497.001System ChecksEvidence1

T1497.001 Virtualization/Sandbox Evasion: System Checks ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ❌ ❌ ❌ ❌

T1518.001Security Software DiscoveryEvidence1

they devote considerable effort to collect screenshots and scan for security software

Collection

5 techniques

T1056Input CaptureEvidence1

Operators need to react to this situation and manually command the malware to display the fake pop-up window and take control of the victim’s machine

T1056.001KeyloggingEvidence1

to steal credentials, they tend to use either fake pop-up windows or keyloggers

T1056.002GUI Input CaptureEvidence1

to steal credentials, they tend to use either fake pop-up windows or keyloggers

T1113Screen CaptureEvidence1

they devote considerable effort to collect screenshots

T1115Clipboard DataEvidence1

T1115 Clipboard Data ✅ ✅ ❌ ❌ ❌ ❌ ✅ ✅ ✅ ❌ ❌ ❌

Command and Control

3 techniques

T1132.002Non-Standard EncodingEvidence1

custom encryption algorithms are favored over established ones

T1219Remote Access ToolsEvidence1

Operators need to react to this situation and manually command the malware to display the fake pop-up window and take control of the victim’s machine

T1571Non-Standard PortEvidence1

T1571 Non-Standard Port ✅ ✅ ✅ ❌ ✅ ❌ ✅ ✅ ✅ ❌ ✅ ✅

Exfiltration

2 techniques

T1041Exfiltration Over C2 ChannelEvidence1

T1041 Exfiltration Over C2 Channel ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅

T1048Exfiltration Over Alternative ProtocolEvidence1

they do not exfiltrate all harvested data to the C&C server, but use different locations as well

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app6 years ago

hash.sha1●●●●●●●●●●●●View more in app—

ACTIVITY FEED

Recent activity

8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

8 SOURCESView more in app

levelblue spiderlabs blogNews

Nov 19, 2025

SpiderLabs IDs New Banking Trojan Distributed Through WhatsApp

Referenced as another malware/injector with a similar custom stream cipher; not the subject of the report.

eset welivesecurity blogNews

Dec 15, 2021

The dirty dozen of Latin America: From Amavaldo to Zumanek

Latin American banking trojan family discussed as one of the active families in ESET's series; it mainly targets banking users and was noted as becoming dormant around November 2020.

securelistNews

May 13, 2021

Bizarro banking Trojan expands its attacks to Europe | Securelist

Referenced as another South American banking trojan expanding operations internationally.

eset welivesecurity blogNews

May 5, 2021

Ousaban: Private photo collection hidden in a CABinet

Referenced as a related LATAM banking trojan sharing code similarities with Ousaban.

+4 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping30

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Amavaldo