Pulse Detail — Threat Intelligence

PULSE NAME

Grandoreiro Banking Malware Resurfaces for Tax Season

WHITE AlienVault 2022-05-27 Modified: 2022-06-26

IOCs

MEDIUM VOLUME

Researchers observed in early April a Grandoreiro malware campaign targeting bank users from Brazil, Spain, and Mexico. The campaign exploits the tax season in target countries by sending out tax-themed phishing emails.

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

T1027 T1199 T1573 T1568 T1056 T1547 T1574 T1560 T1016 T1115

MALWARE FAMILIES

Grandoreiro

Indicators of Compromise (6 / 17 total)

All FileHash-MD5 FileHash-SHA1 FileHash-SHA256 URL domain

TYPE	INDICATOR	DESCRIPTION	CREATED
FileHash-SHA1	1e81d73ff946560692a01c38649227897339dd5a	—	2022-05-27
FileHash-SHA1	5dd0b062dda3991c09e439f0688ba94004573d6e	—	2022-05-27
FileHash-SHA1	7b89ee046f849392a4bf8747ca789f40964ff429	—	2022-05-27
FileHash-SHA1	aadc8a089d1288e91e6ba9e095d37d30de3bbb18	—	2022-05-27
FileHash-SHA1	be3bebab8db0087d92316b5f54b5aaf5f51fbf46	—	2022-05-27
FileHash-SHA1	ff908727cc1b5335e541fbcd80a327565f308bc7	—	2022-05-27

References (1)

↗ https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/grandoreiro-banking-malware-resurfaces-for-tax-season/