Pulse Detail — Threat Intelligence

PULSE NAME

Grandoreiro Banking Malware Resurfaces for Tax Season

WHITE AlienVault 2022-05-27 Modified: 2022-06-26

IOCs

MEDIUM VOLUME

Researchers observed in early April a Grandoreiro malware campaign targeting bank users from Brazil, Spain, and Mexico. The campaign exploits the tax season in target countries by sending out tax-themed phishing emails.

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

T1027 T1199 T1573 T1568 T1056 T1547 T1574 T1560 T1016 T1115

MALWARE FAMILIES

Grandoreiro

Indicators of Compromise (3 / 17 total)

All FileHash-MD5 FileHash-SHA1 FileHash-SHA256 URL domain

TYPE	INDICATOR	DESCRIPTION	CREATED
FileHash-SHA256	0283eebeda2c6554a39d77ab8b1507a1d6393e5a04f7a4de0d2ed9ab5c63f648	SHA256 of be3bebab8db0087d92316b5f54b5aaf5f51fbf46	2022-05-27
FileHash-SHA256	3f74387ec609daca8ec6a0c5a6986f39853a77ab7c414e6d6f950d285ca51f38	SHA256 of aadc8a089d1288e91e6ba9e095d37d30de3bbb18	2022-05-27
FileHash-SHA256	9428536f635ecadaca9288fa0150e92bdcdac7fe8de03e419e032ab0664c86fa	SHA256 of 5dd0b062dda3991c09e439f0688ba94004573d6e	2022-05-27

References (1)

↗ https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/grandoreiro-banking-malware-resurfaces-for-tax-season/