{ "type": "Domain", "indicator": "saogeraldoshiping.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/saogeraldoshiping.com", "alexa": "http://www.alexa.com/siteinfo/saogeraldoshiping.com", "indicator": "saogeraldoshiping.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 4346841860, "indicator": "saogeraldoshiping.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 6, "pulses": [ { "id": "69fb97e531a95b262c4925aa", "name": "TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook", "description": "A sophisticated Brazilian banking trojan named TCLBANKER has been identified, representing a significant evolution of the MAVERICK/SORVEPOTEL malware family. The campaign employs a trojanized Logitech installer that deploys two .NET Reactor-protected modules through DLL side-loading. The banking trojan monitors 59 Brazilian financial institutions using UI Automation and features a WPF-based full-screen overlay framework for operator-driven social engineering attacks, including credential harvesting and fake system screens. A secondary worm module enables self-propagation through WhatsApp session hijacking and Outlook COM automation, sending phishing messages from victims' own accounts. The malware implements robust anti-analysis capabilities including environment-gated payload decryption, comprehensive watchdog systems, and ETW patching. Infrastructure is hosted on Cloudflare Workers, with evidence suggesting the campaign was detected in early operational stages.", "modified": "2026-05-08T08:45:54.662000", "created": "2026-05-06T19:35:01.669000", "tags": [ "whatsapp worm", "tclbanker", "maverick", "sorvepotel" ], "references": [ "https://www.elastic.co/security-labs/tclbanker-brazilian-banking-trojan" ], "public": 1, "adversary": "REF3076", "targeted_countries": [], "malware_families": [ { "id": "TCLBANKER", "display_name": "TCLBANKER", "target": null }, { "id": "MAVERICK", "display_name": "MAVERICK", "target": null }, { "id": "SORVEPOTEL", "display_name": "SORVEPOTEL", "target": null } ], "attack_ids": [], "industries": [ "Finance" ], "TLP": "white", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1, "FileHash-SHA1": 2, "FileHash-SHA256": 4, "domain": 7, "hostname": 1 }, "indicator_count": 15, "is_author": false, "is_subscribing": null, "subscriber_count": 386478, "modified_text": "22 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "5fa1852d337eca8e99c2ec32", "name": "Malware - Malware Domain Feed V2 - November 03 2020", "description": "Command and Control domains for Malware. These domains are extracted from a number of sources, and are suspicious.", "modified": "2026-05-30T03:19:46.084000", "created": "2020-11-03T16:28:29.011000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 552427, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 3, "follower_count": 0, "vote": 0, "author": { "username": "otxrobottwo", "id": "78495", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_78495/resized/80/avatar_ba5a8acdbd.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 49967, "domain": 75353 }, "indicator_count": 125320, "is_author": false, "is_subscribing": null, "subscriber_count": 1727, "modified_text": "1 day ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a047bb5f2b9d59bf3636161", "name": "EbeeMay2026 Pt2", "description": "Multiple APT/threat actors, Malware and Campaigns", "modified": "2026-05-13T13:25:09.112000", "created": "2026-05-13T13:25:09.112000", "tags": [ "filehashsha256", "filehashmd5", "filehashsha1", "cve20250921 cve", "cve20260300 cve", "cve20261281 cve", "cve20261340 cve", "cve20261731 cve", "cve20261357 cve", "cve20259501 cve", "yara" ], "references": [ "IOCs.csv" ], "public": 1, "adversary": "JDownloader, DarkCloud, Chaos Ransomware, APT29, Shadow-Earth-053", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 66, "URL": 45, "CVE": 23, "FileHash-MD5": 232, "FileHash-SHA1": 239, "FileHash-SHA256": 264, "domain": 130, "email": 3, "hostname": 41 }, "indicator_count": 1043, "is_author": false, "is_subscribing": null, "subscriber_count": 40, "modified_text": "17 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a01c05dfa507c2e736c894e", "name": "TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook \u2014 Elastic Security Labs", "description": "", "modified": "2026-05-11T11:41:17.699000", "created": "2026-05-11T11:41:17.699000", "tags": [ "tclbanker", "cloudflare", "ref3076", "whatsapp web", "outlook email", "whatsapp bot", "x32dbg", "com interop", "machinename", "username", "worm", "bypass", "next", "verify", "ilspy", "cheatengine", "persistence", "kill", "delta", "enumerate", "contact" ], "references": [ "https://www.elastic.co/security-labs/tclbanker-brazilian-banking-trojan" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 1, "FileHash-MD5": 4, "FileHash-SHA1": 5, "FileHash-SHA256": 4, "URL": 2, "domain": 8, "hostname": 1 }, "indicator_count": 25, "is_author": false, "is_subscribing": null, "subscriber_count": 864, "modified_text": "19 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a016000ee4c7bcaf4f232e3", "name": "TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook", "description": "", "modified": "2026-05-11T04:50:08.373000", "created": "2026-05-11T04:50:08.373000", "tags": [ "whatsapp worm", "tclbanker", "maverick", "sorvepotel" ], "references": [ "https://www.elastic.co/security-labs/tclbanker-brazilian-banking-trojan" ], "public": 1, "adversary": "REF3076", "targeted_countries": [], "malware_families": [ { "id": "TCLBANKER", "display_name": "TCLBANKER", "target": null }, { "id": "MAVERICK", "display_name": "MAVERICK", "target": null }, { "id": "SORVEPOTEL", "display_name": "SORVEPOTEL", "target": null } ], "attack_ids": [], "industries": [ "Finance" ], "TLP": "white", "cloned_from": "69fb97e531a95b262c4925aa", "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1, "FileHash-SHA1": 2, "FileHash-SHA256": 4, "domain": 7, "hostname": 1 }, "indicator_count": 15, "is_author": false, "is_subscribing": null, "subscriber_count": 278, "modified_text": "19 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a01471a72768cc0b756b152", "name": "IOC - TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook", "description": "", "modified": "2026-05-11T03:03:54.963000", "created": "2026-05-11T03:03:54.963000", "tags": [ "whatsapp worm", "tclbanker", "maverick", "sorvepotel" ], "references": [ "https://www.elastic.co/security-labs/tclbanker-brazilian-banking-trojan" ], "public": 1, "adversary": "REF3076", "targeted_countries": [], "malware_families": [ { "id": "TCLBANKER", "display_name": "TCLBANKER", "target": null }, { "id": "MAVERICK", "display_name": "MAVERICK", "target": null }, { "id": "SORVEPOTEL", "display_name": "SORVEPOTEL", "target": null } ], "attack_ids": [], "industries": [ "Finance" ], "TLP": "white", "cloned_from": "69fb97e531a95b262c4925aa", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "celestre", "id": "295357", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1, "FileHash-SHA1": 2, "FileHash-SHA256": 4, "domain": 7, "hostname": 1 }, "indicator_count": 15, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "20 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://www.elastic.co/security-labs/tclbanker-brazilian-banking-trojan", "IOCs.csv" ], "related": { "alienvault": { "adversary": [ "REF3076" ], "malware_families": [ "Maverick", "Sorvepotel", "Tclbanker" ], "industries": [ "Finance" ] }, "other": { "adversary": [ "JDownloader, DarkCloud, Chaos Ransomware, APT29, Shadow-Earth-053", "REF3076" ], "malware_families": [ "Maverick", "Sorvepotel", "Tclbanker" ], "industries": [ "Finance" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 6, "pulses": [ { "id": "69fb97e531a95b262c4925aa", "name": "TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook", "description": "A sophisticated Brazilian banking trojan named TCLBANKER has been identified, representing a significant evolution of the MAVERICK/SORVEPOTEL malware family. The campaign employs a trojanized Logitech installer that deploys two .NET Reactor-protected modules through DLL side-loading. The banking trojan monitors 59 Brazilian financial institutions using UI Automation and features a WPF-based full-screen overlay framework for operator-driven social engineering attacks, including credential harvesting and fake system screens. A secondary worm module enables self-propagation through WhatsApp session hijacking and Outlook COM automation, sending phishing messages from victims' own accounts. The malware implements robust anti-analysis capabilities including environment-gated payload decryption, comprehensive watchdog systems, and ETW patching. Infrastructure is hosted on Cloudflare Workers, with evidence suggesting the campaign was detected in early operational stages.", "modified": "2026-05-08T08:45:54.662000", "created": "2026-05-06T19:35:01.669000", "tags": [ "whatsapp worm", "tclbanker", "maverick", "sorvepotel" ], "references": [ "https://www.elastic.co/security-labs/tclbanker-brazilian-banking-trojan" ], "public": 1, "adversary": "REF3076", "targeted_countries": [], "malware_families": [ { "id": "TCLBANKER", "display_name": "TCLBANKER", "target": null }, { "id": "MAVERICK", "display_name": "MAVERICK", "target": null }, { "id": "SORVEPOTEL", "display_name": "SORVEPOTEL", "target": null } ], "attack_ids": [], "industries": [ "Finance" ], "TLP": "white", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1, "FileHash-SHA1": 2, "FileHash-SHA256": 4, "domain": 7, "hostname": 1 }, "indicator_count": 15, "is_author": false, "is_subscribing": null, "subscriber_count": 386478, "modified_text": "22 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "5fa1852d337eca8e99c2ec32", "name": "Malware - Malware Domain Feed V2 - November 03 2020", "description": "Command and Control domains for Malware. These domains are extracted from a number of sources, and are suspicious.", "modified": "2026-05-30T03:19:46.084000", "created": "2020-11-03T16:28:29.011000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 552427, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 3, "follower_count": 0, "vote": 0, "author": { "username": "otxrobottwo", "id": "78495", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_78495/resized/80/avatar_ba5a8acdbd.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 49967, "domain": 75353 }, "indicator_count": 125320, "is_author": false, "is_subscribing": null, "subscriber_count": 1727, "modified_text": "1 day ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a047bb5f2b9d59bf3636161", "name": "EbeeMay2026 Pt2", "description": "Multiple APT/threat actors, Malware and Campaigns", "modified": "2026-05-13T13:25:09.112000", "created": "2026-05-13T13:25:09.112000", "tags": [ "filehashsha256", "filehashmd5", "filehashsha1", "cve20250921 cve", "cve20260300 cve", "cve20261281 cve", "cve20261340 cve", "cve20261731 cve", "cve20261357 cve", "cve20259501 cve", "yara" ], "references": [ "IOCs.csv" ], "public": 1, "adversary": "JDownloader, DarkCloud, Chaos Ransomware, APT29, Shadow-Earth-053", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 66, "URL": 45, "CVE": 23, "FileHash-MD5": 232, "FileHash-SHA1": 239, "FileHash-SHA256": 264, "domain": 130, "email": 3, "hostname": 41 }, "indicator_count": 1043, "is_author": false, "is_subscribing": null, "subscriber_count": 40, "modified_text": "17 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a01c05dfa507c2e736c894e", "name": "TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook \u2014 Elastic Security Labs", "description": "", "modified": "2026-05-11T11:41:17.699000", "created": "2026-05-11T11:41:17.699000", "tags": [ "tclbanker", "cloudflare", "ref3076", "whatsapp web", "outlook email", "whatsapp bot", "x32dbg", "com interop", "machinename", "username", "worm", "bypass", "next", "verify", "ilspy", "cheatengine", "persistence", "kill", "delta", "enumerate", "contact" ], "references": [ "https://www.elastic.co/security-labs/tclbanker-brazilian-banking-trojan" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 1, "FileHash-MD5": 4, "FileHash-SHA1": 5, "FileHash-SHA256": 4, "URL": 2, "domain": 8, "hostname": 1 }, "indicator_count": 25, "is_author": false, "is_subscribing": null, "subscriber_count": 864, "modified_text": "19 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a016000ee4c7bcaf4f232e3", "name": "TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook", "description": "", "modified": "2026-05-11T04:50:08.373000", "created": "2026-05-11T04:50:08.373000", "tags": [ "whatsapp worm", "tclbanker", "maverick", "sorvepotel" ], "references": [ "https://www.elastic.co/security-labs/tclbanker-brazilian-banking-trojan" ], "public": 1, "adversary": "REF3076", "targeted_countries": [], "malware_families": [ { "id": "TCLBANKER", "display_name": "TCLBANKER", "target": null }, { "id": "MAVERICK", "display_name": "MAVERICK", "target": null }, { "id": "SORVEPOTEL", "display_name": "SORVEPOTEL", "target": null } ], "attack_ids": [], "industries": [ "Finance" ], "TLP": "white", "cloned_from": "69fb97e531a95b262c4925aa", "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1, "FileHash-SHA1": 2, "FileHash-SHA256": 4, "domain": 7, "hostname": 1 }, "indicator_count": 15, "is_author": false, "is_subscribing": null, "subscriber_count": 278, "modified_text": "19 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a01471a72768cc0b756b152", "name": "IOC - TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook", "description": "", "modified": "2026-05-11T03:03:54.963000", "created": "2026-05-11T03:03:54.963000", "tags": [ "whatsapp worm", "tclbanker", "maverick", "sorvepotel" ], "references": [ "https://www.elastic.co/security-labs/tclbanker-brazilian-banking-trojan" ], "public": 1, "adversary": "REF3076", "targeted_countries": [], "malware_families": [ { "id": "TCLBANKER", "display_name": "TCLBANKER", "target": null }, { "id": "MAVERICK", "display_name": "MAVERICK", "target": null }, { "id": "SORVEPOTEL", "display_name": "SORVEPOTEL", "target": null } ], "attack_ids": [], "industries": [ "Finance" ], "TLP": "white", "cloned_from": "69fb97e531a95b262c4925aa", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "celestre", "id": "295357", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1, "FileHash-SHA1": 2, "FileHash-SHA256": 4, "domain": 7, "hostname": 1 }, "indicator_count": 15, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "20 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "saogeraldoshiping.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "saogeraldoshiping.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780200874.563352 }