Grandoreiro remains active in Latin America, with recent campaigns using Duplicate Files Finder DLL sideloading, heavy anti-analysis checks, and encrypted C2 communications to evade detection. Telemetry from June 2026 shows Mexico as the primary hotspot, while the campaign also uses spoofed filenames, decoy documents, and a broad blacklist of tools, hosts, and virtualized environments. #Grandoreiro #DuplicateFilesFinder #ip-api.com #nhlfan.net
Keypoints
- Grandoreiro continues to operate despite major disruption efforts in 2024.
- The campaign abuses the legitimate Duplicate Files Finder application to perform DLL sideloading.
- The loader includes extensive anti-analysis logic, such as sandbox checks, VM artifact detection, and process blacklisting.
- The malware queries ip-api.com for victim geolocation and blacklists specific countries, including CZ, RU, and NL.
- Grandoreiro contacts a hardcoded C2 domain using DNS-over-HTTPS and then issues encrypted HTTP requests over TCP port 6432.
- Telemetry from the last 30 days of June 2026 shows Mexico as the main source of detections, with additional activity in Spain, Europe, and North America.
- The malware uses custom string obfuscation based on Base64 and XOR to hinder static analysis.
MITRE Techniques
- [T1574.002 ] Hijack Execution Flow: DLL Side-Loading – Grandoreiro loads a malicious DLL beside a legitimate executable to execute attacker code through the normal Windows search order. (‘Duplicate Files Finder … use DLL sideloading techniques’)
- [T1497.001 ] Virtualization/Sandbox Evasion: System Checks – The loader checks uptime, desktop shortcuts, VM drivers, BIOS values, and other environment traits to avoid sandboxes. (‘sandbox detection, virtual machine artifact checks, process blacklisting and environment profiling’)
- [T1082 ] System Information Discovery – It gathers host details such as memory, processors, disk space, screen resolution, and recent activity. (‘it gathers information about the amount of installed physical memory … the screen resolution … recent user activity’)
- [T1016 ] System Network Configuration Discovery – The malware determines the victim’s public IP and related network/geolocation context. (‘contacts ip-api.com to determine the victim’s public IP address and geolocation’)
- [T1614 ] System Location Discovery – It uses geolocation to identify and blacklist countries. (‘It then blacklists several countries, including CZ, RU and NL’)
- [T1057 ] Process Discovery – It checks for 49 running processes associated with debuggers, sniffers, reverse engineering tools, and EDR products. (‘the malware specifically checks for the presence of tools commonly used in debugging, reverse engineering, and network traffic analysis’)
- [T1140 ] Deobfuscate/Decode Files or Information – The sample uses custom Base64 plus XOR string decoding to hide runtime strings. (‘combines a proprietary decryption routine with Base64 encoding’)
- [T1036.005 ] Masquerading: Match Legitimate Name or Location – The legitimate Duplicate Files Finder binary is renamed to a random filename to obscure its purpose. (‘rename it to a randomly generated filename to obscure its purpose’)
- [T1071.001 ] Application Layer Protocol: Web Protocols – The malware retrieves its second stage using HTTP GET over TCP port 6432. (‘issues an HTTP GET request over TCP port 6432 to retrieve the second-stage payload’)
- [T1071.004 ] Application Layer Protocol: DNS – The malware resolves its C2 IP using Google’s DNS-over-HTTPS endpoint. (‘leverages Google’s DNS-over-HTTPS service’)
- [T1564.003 ] Hidden Window – The implant hides the GUI window on execution to avoid user attention. (‘it first loads another legitimate dependency … the malicious implant begins its execution by hiding the application window’)
Indicators of Compromise
- [File names ] Initial archive and loader artifacts – Fac-BH22DC0608_RevMQKSAC.zip, _2IH4ENJIRRNCobran_03732qyykae214BKXXN6180-Dt.exe
- [MD5 hashes ] Sample and DLL hashes – 82f771c3ec4fe979c3ae00372e8c3ac8, cfbd8d062e9baa98737a0260996f48c6
- [SHA-256 hashes ] Sample hashes – 1b2fe30c5bf57f9623efb34688580fe5bbb2c55351c5a07a6c4313bb6faa29f11, fe5a72aefc38afeeee72d8a939f9db50800a447b7313f4d8c504771bb7fa2de2
- [File names ] Sideload chain DLLs – dupfdll.dll, mingwm10.dll
- [Domains ] C2 and infrastructure domains – b744156103040828396040[.]nhlfan[.]net, 445675885304004[.]pointto[.]us
- [URLs ] DNS-over-HTTPS and C2-related requests – hxxps://dns[.]google/resolve?name=, hxxp://b744156103040828396040[.]nhlfan[.]net:6432
- [Registry paths ] VM-related checks – HARDWAREDESCRIPTIONSystemBIOS, SOFTWAREVMware, Inc.VMware Tools
- [Process names ] Blacklisted tools – Wireshark.exe, x64dbg.exe, and other 47 process names
- [System paths ] Sandbox-related directories – A:TOOLSProcessInvestigator, C:TOOLSProcessInvestigator, and other listed paths