ThreatLabz observed a Grandoreiro banking Trojan campaign targeting Mexico and Spain across multiple industry verticals, using spear-phishing emails that impersonate government officials to lure victims to download and execute Grandoreiro. The loader employs anti-analysis tricks, binary padding, Captcha for sandbox evasion, and LatentBot-like C2 patterns before delivering the final payload. Hashtags: #Grandoreiro #LatentBot
Keypoints
- Campaign targets Spanish-speaking countries (Mexico and Spain) across various industries, including Automotive, Chemicals Manufacturing, and more.
- Threat actors impersonate government officials (Attorney General’s Office of Mexico City and Public Ministry) in spear-phishing emails to push Grandoreiro.
- The infection chain begins with a spear-phishing email in Spanish that redirects to a malicious domain to download a ZIP containing the Grandoreiro Loader.
- Grandoreiro Loader employs anti-analysis techniques (including Captcha for sandbox evasion and binary padding) and checks for analysis tools before execution.
- The C2 pattern in the 2022 variant is identical to LatentBot, using an ACTION=HELLO beacon and ID-based communication.
- Persistence and data collection steps include Run Registry startup and gathering system/user information (username, computer name, OS/version) before contacting C2.
- Final payload is a large, signed, obfuscated DLL/EXE delivered via a 9–400 MB binary padding approach, with Domain Generation Algorithm-based C2 and multiple check-in URLs.
MITRE Techniques
- [T1566.002] Phishing: Spearphishing Link – The infection chain begins with spear-phishing emails in Spanish that lure victims to download the loader. “The infection chain employed by the threat actors in this campaign is quite similar to previous Grandoreiro campaigns. It begins with a spear-phishing email written in Spanish, targeting victims in Mexico and Spain.”
- [T1204] User Execution – Users click embedded links that download and execute the Grandoreiro Loader and final payload. “The infection chain employed by the threat actors in this campaign is quite similar to previous Grandoreiro campaigns. It begins with a spear-phishing email … which would download the Grandoreiro Loader.”
- [T1140] Deobfuscate/Decode Files or Information – The loader performs XOR-based string decryption to reveal URLs and parameters. “This string decryption routine has been used previously in the older variants of Grandoreiro for decrypting strings and API calls…”
- [T1082] System Information Discovery – The loader collects system and user information (username, computer name, OS/version) prior to C2 communication. “The following System and User information … retrieves Username, ComputerName, Operating System and Version.”
- [T1057] Process Discovery – Anti-analysis checks include enumerating running processes to detect analysis tools (e.g., Regmon.exe, Procmon.exe). “The malware detects the below mentioned analysis tools by decrypting the tool names using a XOR-based Decryption routine. It then takes a snapshot of currently executing processes…”
- [T1071.001] Application Layer Protocol: Web Protocols – C2 traffic and beacon pattern (ACTION=HELLO) resemble LatentBot with ID-based communication. “The Grandoreiro Loader then sends across a GET/POST to the decrypted URL … and uses the ‘ACTION=HELLO’ beacon and ID-based communication.”
- [T1547.001] Boot or Logon Autostart Execution – The final payload persists via Run Registry startup entries. “The final payload maintains persistence on the Machine by leveraging the Run Registry key…”
- [T1116] Signed Binary Proxy Execution – The final payload is signed with a digital ASUSTek certificate to appear legitimate. “the final payload is signed with an ‘ASUSTek DRIVER ASSISTANTE’ digital certificate to appear legitimate…”
- [T1497] Virtualization/Sandbox Evasion – VM detection techniques (Vmware I/O port checks) are used to evade analysis. “Vmware I/O Port Anti-VM Technique: the malware checks whether execution occurs in a virtual environment by reading data from the I/O Port ‘0x5658h’ (VX)…”
Indicators of Compromise
- [Domain] Embedded domains used for check-in/downloads – barusgorlerat.me, damacenapirescontab.com
- [IP Address] Loader/file download hosts – 35[.]181[.]59[.]254, 35[.]180[.]117[.]32, 52[.]67[.]27[.]173, 54[.]232[.]38[.]61
- [URL] Loader ZIP download links – 35[.]181[.]59[.]254/info99908hhzzb.zip, 35[.]180[.]117[.]32/$FISCALIGENERAL3489213839012
- [URL] Final payload/check-in URLs – http[:]//15[.]188[.]63[.]127/$TIME, http[:]//167[.]114[.]137[.]244/$TIME
- [URL] C2 domains and check-in domains – barusgorlerat[.]me, assesorattlas[.]me, perfomacepnneu[.]me
- [MD5] Grandoreiro Loader hashes – 970f00d7383e44538cac7f6d38c23530, 724f26179624dbb9918609476ec0fce4
- [MD5] Grandoreiro Final Payload hashes – e02c77ecaf1ec058d23d2a9805931bf8, 6ab9b317178e4b2b20710de96e8b36a0