Netskope Threat Labs

Metamorfo

ATP Sandbox Adv. HeuristicsAV

Description

Casbaneiro (a.k.a. Metamorfo) is a banking trojan that aims to steal sensitive financial data, similar to other families sourced from Latin America such as Guildma, Grandoreiro, and Ousaban. It arrives through spam emails with malicious attachments or links, uses fake installers to trick users into running it, and injects code into banking websites to capture credentials. The family's operators maintain Portuguese and Spanish language lures that focus on customers of banks in Brazil, Mexico, and other regional targets.

Stats

First seen
November 2022
Last seen
September 2026

Also known as

Casbaneiro

MITRE ATT&CK techniques

46 techniques across 10 tactics.

TA0001 Initial Access

TA0002 Execution

TA0003 Persistence

  • T1547Boot or Logon Autostart Execution

TA0005 Stealth

TA0007 Discovery

  • T1010Application Window Discovery
  • T1033System Owner/User Discovery
  • T1057Process Discovery
  • T1082System Information Discovery
  • T1083File and Directory Discovery
  • T1124System Time Discovery
  • T1518Software Discovery

TA0009 Collection

TA0011 Command and Control

TA0010 Exfiltration

  • T1041Exfiltration Over C2 Channel

TA0040 Impact

TA0112 Defense Impairment

Alert name variants

Alert Name
Gen:Variant.Casbaneiro.2
Script-AutoIt.Trojan.Casbaneiro
Script-PowerShell.Trojan.Metamorfo
Script-WScript.Downloader.Casbaneiro
Win32.Infostealer.Casbaneiro
Win32.Spyware.Casbaneiro
Win32.Spyware.Metamorfo
Win32.Trojan.Casbaneiro

Related blogs

Related families

QakBotInvisiMolePlugXGrandoreiroRTM

References