{
  "family": "amavaldo",
  "sample_count": 5,
  "category": "trojan",
  "description": "Trojan:Win32/Amavaldo is a highly sophisticated banking trojan known for its complex, multi-stage infection chain and its specific geographic targeting (frequently focusing on users and financial institutions in Brazil and Latin America). Amavaldo is designed to steal banking credentials, intercept two-factor authentication (MFA) codes, and allow attackers to perform fraudulent transactions while the victim is actively logged in.<br><br><b>Understanding Amavaldo</b><br>To a victim, an Amavaldo infection is invisible until money is missing from their accounts or they are presented with a highly realistic, full-screen fake banking login page that prevents them from doing anything else until they enter their credentials. For a financial institution, it represents a critical threat capable of defeating standard anti-fraud measures.<br><br><b>Execution and Web Injection Mechanics</b><br>Amavaldo relies heavily on spear-phishing emails containing malicious MSI installers or VBScript droppers hidden inside ZIP archives (`T1566.001`). The infection chain is notably complex, often using legitimate dual-use tools (like PowerShell or certutil) to download subsequent stages, heavily utilizing 'Living off the Land' (LotL) tactics (`T1059.001`). Once the final payload is running, it achieves persistence (`T1547.001`) and embeds itself into web browsers. When the victim navigates to a targeted banking URL, Amavaldo uses advanced 'Web Injects' and overlay screens (`T1185`) to dynamically alter the bank's page, capturing keystrokes and MFA tokens, and sending them directly to the attacker's C2 server (`T1071.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is direct, massive financial theft. Host-based IoCs include EDR alerts for `msiexec.exe` or `wscript.exe` downloading payloads from unusual, randomly generated URLs. The presence of heavily obfuscated scripts in the `%AppData%` directory is common. Network IoCs include the downloading of 'web inject' configuration files and outbound communication to C2 panels.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.001",
    "T1185",
    "T1555.003",
    "T1059.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1185",
      "name": "Browser Session Hijacking (Web Injects / Overlays)",
      "tactic": "Collection"
    },
    {
      "id": "T1059.001",
      "name": "Command and Scripting Interpreter: PowerShell (Used in infection chain)",
      "tactic": "Execution"
    },
    {
      "id": "T1555.003",
      "name": "Credentials from Password Stores: Credentials from Web Browsers",
      "tactic": "Credential Access"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment (Malicious MSI files)",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network to sever the C2 connection and prevent the attacker from initiating fraudulent transactions.",
    "Contact the victim's financial institutions immediately to freeze accounts and alert them to the high probability of a Man-in-the-Browser compromise.",
    "Assume all web credentials stored on or entered into the machine have been stolen, and mandate enterprise-wide password resets.",
    "Analyze the entire complex infection chain (VBScript -> PowerShell -> Payload) to identify all dropped artifacts for complete removal."
  ],
  "what_to_avoid": [
    "Do not rely on standard MFA (like SMS codes) to protect accounts if Amavaldo is suspected, as the attacker is actively intercepting those codes via the overlay.",
    "Avoid simply running an AV scan and leaving the machine online; banking trojans require a complete wipe and reimage to ensure the deep API hooks are removed."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}