Malware

Lokorrito

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

22 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques

T1566PhishingEvidence1

The campaigns we see always come in waves and more than 90% of them are distributed through spam.

T1566.001Spearphishing AttachmentEvidence1

T1566.001 Phishing: Spearphishing Attachment ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅

T1566.002Spearphishing LinkEvidence1

T1566.002 Phishing: Spearphishing Link ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ❌ ✅ ✅

Execution

1 technique

T1059.005Visual BasicEvidence1

they heavily rely on scripting languages, mainly VBScript

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Registry Run key or Startup folder are the most common methods of persistence

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Registry Run key or Startup folder are the most common methods of persistence

Stealth

2 techniques

T1140Deobfuscate/Decode Files or InformationEvidence1

they all obfuscate either payloads or configuration data in some way

T1497.001System ChecksEvidence1

T1497.001 Virtualization/Sandbox Evasion: System Checks ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ❌ ❌ ❌ ❌

Credential Access

6 techniques

T1056Input CaptureEvidence1

Operators need to react to this situation and manually command the malware to display the fake pop-up window and take control of the victim’s machine

T1056.001KeyloggingEvidence1

to steal credentials, they tend to use either fake pop-up windows or keyloggers

T1056.002GUI Input CaptureEvidence1

to steal credentials, they tend to use either fake pop-up windows or keyloggers

T1528Steal Application Access TokenEvidence1

Finally, we identified a simple infostealer designed to steal the victim’s Outlook address book and a password stealer intended to harvest Outlook and FileZilla credentials.

T1555Credentials from Password StoresEvidence1

Finally, we identified a simple infostealer designed to steal the victim’s Outlook address book and a password stealer intended to harvest Outlook and FileZilla credentials.

T1555.003Credentials from Web BrowsersEvidence1

T1555.003 Credentials from Password Stores: Credentials from Web Browsers ✅ ✅ ✅ ✅ ❌ ✅ ✅ ✅ ✅ ❌ ❌ ❌

Discovery

6 techniques

T1010Application Window DiscoveryEvidence1

periodically scanning active windows based on name or title

T1057Process DiscoveryEvidence1

T1057 Process Discovery ❌ ✅ ✅ ❌ ✅ ✅ ✅ ✅ ✅ ❌ ✅ ❌

T1082System Information DiscoveryEvidence1

T1082 System Information Discovery ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅

T1083File and Directory DiscoveryEvidence1

T1083 File and Directory Discovery ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ❌ ❌ ❌

T1497.001System ChecksEvidence1

T1497.001 Virtualization/Sandbox Evasion: System Checks ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ❌ ❌ ❌ ❌

T1518.001Security Software DiscoveryEvidence1

they devote considerable effort to collect screenshots and scan for security software

Collection

4 techniques

T1056Input CaptureEvidence1

Operators need to react to this situation and manually command the malware to display the fake pop-up window and take control of the victim’s machine

T1056.001KeyloggingEvidence1

to steal credentials, they tend to use either fake pop-up windows or keyloggers

T1056.002GUI Input CaptureEvidence1

to steal credentials, they tend to use either fake pop-up windows or keyloggers

T1113Screen CaptureEvidence1

they devote considerable effort to collect screenshots

Command and Control

1 technique

T1132.002Non-Standard EncodingEvidence1

custom encryption algorithms are favored over established ones

Exfiltration

2 techniques

T1041Exfiltration Over C2 ChannelEvidence2

The tool generated the emails based on both hardcoded data and data obtained from a C&C server.

T1048Exfiltration Over Alternative ProtocolEvidence1

they do not exfiltrate all harvested data to the C&C server, but use different locations as well

INDICATORS OF COMPROMISE

IOCs tracked for this family

11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

10 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app5 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

eset welivesecurity blogNews

Dec 15, 2021

The dirty dozen of Latin America: From Amavaldo to Zumanek

Dormant Latin American banking trojan family active mainly in Mexico, with country-specific builds and related modules including a backdoor, spam tool, Outlook address-book infostealer, and credential stealer for Outlook and FileZilla.

eset welivesecurity blogNews

Oct 1, 2020

LATAM financial cybercrime: Competitors-in-crime sharing TTPs

Latin American banking trojan family included among malware families exhibiting overlapping implementation and operational techniques.

eset assetsNews

May 26, 2026

Latin American banking trojan that uses the common banking-trojan workflow of system profiling and fake banking pop-up windows. It has used DLL side-loading and shared VBScript obfuscation tooling with Casbaneiro.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching11

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping22

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Lokorrito

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

22 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques

T1566PhishingEvidence1

The campaigns we see always come in waves and more than 90% of them are distributed through spam.

T1566.001Spearphishing AttachmentEvidence1

T1566.001 Phishing: Spearphishing Attachment ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅

T1566.002Spearphishing LinkEvidence1

T1566.002 Phishing: Spearphishing Link ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ❌ ✅ ✅

Execution

1 technique

T1059.005Visual BasicEvidence1

they heavily rely on scripting languages, mainly VBScript

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Registry Run key or Startup folder are the most common methods of persistence

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Registry Run key or Startup folder are the most common methods of persistence

Stealth

2 techniques

T1140Deobfuscate/Decode Files or InformationEvidence1

they all obfuscate either payloads or configuration data in some way

T1497.001System ChecksEvidence1

T1497.001 Virtualization/Sandbox Evasion: System Checks ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ❌ ❌ ❌ ❌

Credential Access

6 techniques

T1056Input CaptureEvidence1

Operators need to react to this situation and manually command the malware to display the fake pop-up window and take control of the victim’s machine

T1056.001KeyloggingEvidence1

to steal credentials, they tend to use either fake pop-up windows or keyloggers

T1056.002GUI Input CaptureEvidence1

to steal credentials, they tend to use either fake pop-up windows or keyloggers

T1528Steal Application Access TokenEvidence1

Finally, we identified a simple infostealer designed to steal the victim’s Outlook address book and a password stealer intended to harvest Outlook and FileZilla credentials.

T1555Credentials from Password StoresEvidence1

Finally, we identified a simple infostealer designed to steal the victim’s Outlook address book and a password stealer intended to harvest Outlook and FileZilla credentials.

T1555.003Credentials from Web BrowsersEvidence1

T1555.003 Credentials from Password Stores: Credentials from Web Browsers ✅ ✅ ✅ ✅ ❌ ✅ ✅ ✅ ✅ ❌ ❌ ❌

Discovery

6 techniques

T1010Application Window DiscoveryEvidence1

periodically scanning active windows based on name or title

T1057Process DiscoveryEvidence1

T1057 Process Discovery ❌ ✅ ✅ ❌ ✅ ✅ ✅ ✅ ✅ ❌ ✅ ❌

T1082System Information DiscoveryEvidence1

T1082 System Information Discovery ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅

T1083File and Directory DiscoveryEvidence1

T1083 File and Directory Discovery ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ❌ ❌ ❌

T1497.001System ChecksEvidence1

T1497.001 Virtualization/Sandbox Evasion: System Checks ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ❌ ❌ ❌ ❌

T1518.001Security Software DiscoveryEvidence1

they devote considerable effort to collect screenshots and scan for security software

Collection

4 techniques

T1056Input CaptureEvidence1

Operators need to react to this situation and manually command the malware to display the fake pop-up window and take control of the victim’s machine

T1056.001KeyloggingEvidence1

to steal credentials, they tend to use either fake pop-up windows or keyloggers

T1056.002GUI Input CaptureEvidence1

to steal credentials, they tend to use either fake pop-up windows or keyloggers

T1113Screen CaptureEvidence1

they devote considerable effort to collect screenshots

Command and Control

1 technique

T1132.002Non-Standard EncodingEvidence1

custom encryption algorithms are favored over established ones

Exfiltration

2 techniques

T1041Exfiltration Over C2 ChannelEvidence2

The tool generated the emails based on both hardcoded data and data obtained from a C&C server.

T1048Exfiltration Over Alternative ProtocolEvidence1

they do not exfiltrate all harvested data to the C&C server, but use different locations as well

INDICATORS OF COMPROMISE

IOCs tracked for this family

11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

10 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app5 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

eset welivesecurity blogNews

Dec 15, 2021

The dirty dozen of Latin America: From Amavaldo to Zumanek

eset welivesecurity blogNews

Oct 1, 2020

LATAM financial cybercrime: Competitors-in-crime sharing TTPs

Latin American banking trojan family included among malware families exhibiting overlapping implementation and operational techniques.

eset assetsNews

May 26, 2026

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching11

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping22

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.