Black friday Up to 3 extra licenses FOR FREE + Special offer for TI LOOKUP Get it now

Grandoreiro

94
Global rank
56 infographic chevron month
Month rank
72 infographic chevron week
Week rank
0
IOCs

Grandoreiro is a Latin American banking trojan first observed in 2016. It targets mostly Spanish-speaking countries, such as Brazil, Spain, Mexico and Peru. This malware is operated as a Malware-as-a-Service (MaaS), which makes it easily accessible for cybercriminals. Besides, it uses advanced techniques to evade detection.

Trojan
Type
Unknown
Origin
1 August, 2017
First seen
14 March, 2025
Last seen

How to analyze Grandoreiro with ANY.RUN

Type
Unknown
Origin
1 August, 2017
First seen
14 March, 2025
Last seen

IOCs

IP addresses
15.229.47.198
18.231.154.55
167.114.88.99
15.229.116.173
18.230.211.48
54.207.104.144
18.220.143.143
3.135.202.169
50.114.32.81
15.228.255.38
88.210.12.135
91.142.72.194
70.34.247.142
62.84.100.225
195.85.115.208
80.77.23.10
178.20.45.23
45.11.180.77
80.77.23.221
62.84.98.5
Domains
f3kstbw0tjphtjk.freedynamicdns.org
cortafogoempresarial.shop
ftpxtjf1tqtitkb.freedynamicdns.org
belfaro.com.br
ftpxtar1ujtjtak.freedynamicdns.org
ftpxtaf1sjs4taj.freedynamicdns.org
ftpxtjf1sqo4tbf.freedynamicdns.org
ftpxtjw0xqpktbs.freedynamicdns.org
atendimentoos.duckdns.org
ftpxtbo1uatltjk.freedynamicdns.org
f3kstkk1wqo2tar.freedynamicdns.org
camerahousebusiness.dvrcam.info
ftpxtab1sqtltjg.freedynamicdns.org
f3kstab1uaoetjg.freedynamicdns.org
ftpxtjn1tzoftjb.freedynamicdns.org
health.health-carereform.com
ftpxtkk1sqo1tjw.freedynamicdns.org
ftpxtbw0sathtjo.freedynamicdns.org
ftpxtaw1xqs3tag.freedynamicdns.org
ftpxtas1wzo2tbo.freedynamicdns.org
Last Seen at

Recent blog posts

post image
New Pre-Installed Dev Tools for Deep Sandbox...
watchers 334
comments 0
post image
AI Safety: Key Threats and Solutions 
watchers 444
comments 0
post image
5 Common Evasion Techniques in Malware 
watchers 599
comments 0

What is Grandoreiro malware?

Grandoreiro is a sophisticated banking trojan first observed in 2016, primarily targeting users in Latin America, including countries like Brazil, Mexico, and Argentina.

Grandoreiro is known for its advanced evasion techniques, including various string encryption methods, and the use of a domain generation algorithm (DGA) that enables it to communicate with multiple command-and-control (C2) servers.

In March 2024, the Grandoreiro banking trojan launched a massive attack targeting over 1,500 banks' applications worldwide, expanding beyond its usual Latin American focus to regions in Central and South America, Europe, Africa, and the Indo-Pacific.

Attacks usually begin with phishing campaigns impersonating government entities, tricking recipients into downloading the malware. Once deployed, Grandoreiro targets specific banking applications, allowing attackers to steal credentials and execute fraudulent transactions.

Key technical features of Grandoreiro include its ability to evade detection, verify victims to avoid sandbox environments, and more. The malware’s sophisticated structure and its ability to adapt to different regions and targets make it a significant threat in financial cybercrime.

Get started today for free

Analyze malware and phishing in a fully-interactive sandbox

Create free account

Grandoreiro malware technical details

The main functionality of Grandoreiro malware is to steal sensitive financial information of users by targeting banking applications.

Some of the key capabilities of the Grandoreiro malware include:

  • Initiating attacks through sophisticated phishing campaigns impersonating government and financial institutions.
  • Utilizing a loader that verifies targets, collects data, and downloads the main banking trojan payload.
  • Employing techniques such as file bloating, CAPTCHA pop-ups, and environmental checks to avoid detection by security tools.
  • Targeting banking applications to steal credentials and perform fraudulent transactions.
  • Using a reworked Domain Generation Algorithm (DGA) to connect with multiple command-and-control servers, enabling efficient management of large-scale attacks.
  • Harvesting email addresses from infected hosts and uses Microsoft Outlook to send additional phishing emails, spreading the malware further.
  • Establishing persistence through registry modifications and the creation of configuration files on the victim's machine.

Grandoreiro is a complex malware with over 10,000 strings, which would be easily detectable if left unencrypted. To avoid detection, it uses a sophisticated multi-step decryption process. This involves custom encoding and decryption using the same key as the loader, followed by AES decryption, and then further decoding to finally reveal the plaintext strings, making the malware harder to detect and analyze.

Grandoreiro execution process

To see how Grandoreiro operates, let’s upload its sample to the ANY.RUN sandbox for analysis.

Grandoreiro is typically delivered through phishing emails containing malicious links or attachments. These emails often impersonate legitimate organizations, such as government agencies, to deceive victims. Clicking on the link or opening the attachment downloads a malicious ZIP file containing the Grandoreiro loader, disguised as a PDF or another benign file.

Grandoreiro report in ANY.RUN Grandoreiro process graph displayed in ANY.RUN sandbox

Once executed, the loader performs anti-analysis checks to detect sandboxes and virtual environments. It collects victim information, including IP address, operating system details, installed software, and more. The loader then decrypts a URL using XOR-based decryption and sends a GET request to retrieve the final payload download URL.

The loader downloads the final Grandoreiro payload from the retrieved URL as a large ZIP file. This ZIP file contains a massive executable disguised as an image or PDF file. Then, the loader extracts and renames the executable to a random name with an .exe extension. This renamed executable is the full Grandoreiro banking trojan payload, often signed with a legitimate digital certificate to appear trustworthy and evade detection.

Grandoreiro process in ANY.RUN Malicious process related to Grandoreiro analyzed in ANY.RUN sandbox

Grandoreiro establishes persistence via the Windows registry, ensuring it launches upon user login. It collects more detailed information and sends a POST "check-in" request to the command and control (C2) server with the gathered data. The trojan then proceeds to carry out a range of malicious activities, including browser session hijacking, credential theft, and banking fraud.

Use ANY.RUN free for 14 days

Try the full power of interactive analysis

Start your free trial

Grandoreiro malware distribution methods

Grandoreiro malware is primarily distributed through phishing campaigns.

Attackers often send emails that impersonate legitimate government entities or financial institutions, tricking recipients into clicking on malicious links or downloading infected attachments. These emails may claim to contain important documents, such as tax notices or account statements, which, when opened, initiate the download of the malware.

In addition to phishing emails, Grandoreiro may also be spread through malicious websites that prompt users to download fake software updates or security tools, which actually install the malware.

Conclusion

The impact of the Grandoreiro campaign has been devastating, leading to widespread financial fraud and significant monetary losses. This malware has infiltrated multiple sectors, including banking, finance, manufacturing, public administration, telecommunications, and energy. Its ability to steal sensitive financial information and perform fraudulent transactions has caused severe disruption and harm to countless organizations and individuals, making it one of the most dangerous banking trojans in recent years.

ANY.RUN is a cloud-based service that allows anyone to safely analyze suspicious files and URLs. It enables you to observe malware behavior and collect indicators of compromise in a secure environment. By using ANY.RUN, you can gain valuable insights into Grandoreiro's tactics and improve your defenses against it.

Create your ANY.RUN account – it’s free!

HAVE A LOOK AT

Gh0st RAT screenshot
Gh0st RAT
gh0st
Gh0st RAT is a malware with advanced trojan functionality that enables attackers to establish full control over the victim’s system. The spying capabilities of Gh0st RAT made it a go-to tool for numerous criminal groups in high-profile attacks against government and corporate organizations. The most common vector of attack involving this malware begins with spam and phishing emails.
Read More
Sality screenshot
Sality
sality
Sality is a highly sophisticated malware known for infecting executable files and rapidly spreading across networks. It primarily creates a peer-to-peer botnet that is used for malicious activities such as spamming, data theft, and downloading additional malware. Sality has strong persistence mechanisms, including disabling security software, making it difficult to remove. Its ability to spread quickly and silently, along with its polymorphic nature, allows it to evade detection by traditional antivirus solutions.
Read More
WarmCookie screenshot
WarmCookie
badspace
WarmCookie is a backdoor malware that cyber attackers use to gain initial access to targeted systems. It is often distributed through phishing emails, frequently using job recruitment lures to entice victims into downloading and executing the malware.
Read More