← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook — Elastic Security Labs
WHITE CyberHunter_NL 2026-05-11 Modified: 2026-05-11
25
IOCs
MEDIUM VOLUME
tclbankercloudflareref3076whatsapp weboutlook emailwhatsapp botx32dbgcom interopmachinenameusernamewormbypassnextverifyilspycheatenginepersistencekilldeltaenumeratecontact
Indicators of Compromise (4 / 25 total)
All IPv4 FileHash-MD5 FileHash-SHA1 FileHash-SHA256 URL domain hostname
TYPEINDICATORDESCRIPTIONCREATED
FileHash-MD5 1b143123e7d27f4e9eb429afe465c483 MD5 of 668f932433a24bbae89d60b24eee4a24808fc741f62c5a3043bb7c9152342f40 2026-05-11
FileHash-MD5 87d4f447e11e571dc12f8d1985299ad0 MD5 of 63beb7372098c03baab77e0dfc8e5dca5e0a7420f382708a4df79bed2d900394 2026-05-11
FileHash-MD5 d2ca15781ebc104a7031c8982dafa8ab MD5 of 8a174aa70a4396547045aef6c69eb0259bae1706880f4375af71085eeb537059 2026-05-11
FileHash-MD5 e0d1eedaa0c1f98f50726df729594edc MD5 of 701d51b7be8b034c860bf97847bd59a87dca8481c4625328813746964995b626 2026-05-11
References (1)
↗ https://www.elastic.co/security-labs/tclbanker-brazilian-banking-trojan