Grandoreiro

Description

Grandoreiro is a Latin American banking trojan with the goal of stealing sensitive banking information, and it commonly targets customers of banks in Brazil, Mexico, Spain, and Peru. It arrives through spam emails that lead to fake installer pages, and it overlays fake windows on banking sites to capture credentials and manipulate transactions. The family's operators run it as a managed service for regional fraud crews, and its code base has forked into related Latin American bankers.

Stats

First seen: May 2022
Last seen: October 2026

MITRE ATT&CK techniques

43 techniques across 11 tactics.

TA0001 Initial Access

T1189Drive-by Compromise
T1566Phishing
- T1566.002Spearphishing Link

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.005Visual Basic
T1106Native API
T1204User Execution
- T1204.001Malicious Link
- T1204.002Malicious File

TA0003 Persistence

T1176Software Extensions
- T1176.001Browser Extensions
T1547Boot or Logon Autostart Execution
- T1547.009Shortcut Modification
- T1547.001Registry Run Keys / Startup Folder

TA0004 Privilege Escalation

T1548Abuse Elevation Control Mechanism
- T1548.002Bypass User Account Control

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
- T1027.011Fileless Storage
- T1027.001Binary Padding
T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
T1070Indicator Removal
- T1070.004File Deletion
T1140Deobfuscate/Decode Files or Information
T1218System Binary Proxy Execution
- T1218.007Msiexec
T1497Virtualization/Sandbox Evasion
- T1497.001System Checks

TA0006 Credential Access

T1539Steal Web Session Cookie
T1555Credentials from Password Stores
- T1555.003Credentials from Web Browsers

TA0007 Discovery

T1010Application Window Discovery
T1016System Network Configuration Discovery
T1033System Owner/User Discovery
T1057Process Discovery
T1082System Information Discovery
T1087Account Discovery
- T1087.003Email Account
T1124System Time Discovery
T1518Software Discovery
- T1518.001Security Software Discovery

TA0009 Collection

T1056Input Capture
- T1056.001Keylogging
T1115Clipboard Data
T1185Browser Session Hijacking

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1102Web Service
- T1102.001Dead Drop Resolver
- T1102.002Bidirectional Communication
T1105Ingress Tool Transfer
T1568Dynamic Resolution
- T1568.002Domain Generation Algorithms
T1573Encrypted Channel
- T1573.002Asymmetric Cryptography

TA0010 Exfiltration

T1041Exfiltration Over C2 Channel

TA0112 Defense Impairment

T1112Modify Registry
T1222File and Directory Permissions Modification
- T1222.001Windows Permissions
T1685Disable or Modify Tools
T1686Disable or Modify System Firewall
- T1686.002Network Device Firewall
T1686Disable or Modify System Firewall
- T1686.002Network Device Firewall

Alert name variants

Alert Name	Engine
Archive-ZIP.Trojan.Grandoreiro	ATP Sandbox Adv. Heuristics
Binary.Malware.Grandoreiro	ATP Sandbox Adv. Heuristics
Binary.Trojan.Grandoreiro	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Trojan.Grandoreiro	ATP Sandbox Adv. Heuristics
Gen:Variant.Grandoreiro.1	AV
Gen:Variant.Grandoreiro.2	AV
Script-WScript.Trojan.Grandoreiro	ATP Sandbox Adv. Heuristics
Shortcut.Trojan.Grandoreiro	ATP Sandbox Adv. Heuristics
Trojan.Grandoreiro.1	AV
Trojan.Grandoreiro.A	AV
Trojan.Grandoreiro.B	AV
Trojan.Grandoreiro.C	AV
Trojan.Grandoreiro.R	AV
Win32.Downloader.Grandoreiro	ATP Sandbox Adv. Heuristics
Win32.Infostealer.Grandoreiro	ATP Sandbox Adv. Heuristics
Win32.Spyware.Grandoreiro	ATP Sandbox Adv. Heuristics
Win32.Trojan.Grandoreiro	ATP Sandbox Adv. Heuristics
Win64.Trojan.Grandoreiro	ATP Sandbox Adv. Heuristics