{
  "family": "bancteian",
  "sample_count": 91,
  "category": "trojan",
  "description": "Trojan:Win32/Bancteian is a stealthy, targeted banking trojan engineered to quietly infiltrate endpoints, monitor user browsing activity, and harvest sensitive financial credentials through the use of localized web-injects and keylogging.<br><br><b>Understanding Bancteian</b><br>To the victim, a Bancteian infection is entirely invisible until fraudulent transactions appear on their bank statements. For threat intelligence analysts, Bancteian represents a specialized financial threat. Unlike noisy adware, Bancteian is designed for maximum stealth. Its primary objective is to lay dormant until the victim navigates to a targeted banking or financial portal, at which point it activates to steal credentials and bypass Two-Factor Authentication (2FA).<br><br><b>Execution and Evasion Strategies</b><br>Bancteian is typically distributed via targeted spearphishing campaigns masquerading as invoices or shipping documents, containing malicious macros or exploit code. Upon execution, it utilizes heavy packing and obfuscation to evade static AV. It establishes persistence via Registry Run keys and injects its core monitoring DLL into the web browser processes (`chrome.exe`, `iexplore.exe`). When the user visits a targeted bank, Bancteian utilizes 'Man-in-the-Browser' (MitB) techniques, seamlessly injecting malicious HTML/JavaScript into the legitimate banking page to request additional information (like ATM PINs or 2FA tokens) directly from the user.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is immediate, catastrophic financial loss. Threat hunters should investigate EDR alerts for 'Browser Process Injection' or 'Suspicious API Hooking'. Network logs will reveal Bancteian reaching out to custom C2 infrastructure to download updated web-inject configuration files. Memory forensics is critical to extract the injected Bancteian DLLs and analyze the localized target lists (the specific banks the trojan is programmed to attack).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1110",
    "T1566.001",
    "T1055",
    "T1185",
    "T1056.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1185",
      "name": "Browser Session Hijacking",
      "tactic": "Collection"
    },
    {
      "id": "T1056.004",
      "name": "Input Capture: Credential API Hooking",
      "tactic": "Credential Access"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1110",
      "name": "Brute Force",
      "tactic": "Credential Access"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network to halt the active exfiltration of banking credentials and prevent interactive MitB sessions.",
    "Assist the user in immediately contacting their financial institutions to freeze accounts, block recent transactions, and reset all passwords.",
    "Capture a live memory image (RAM dump) to extract the injected Bancteian DLLs and the downloaded web-inject configuration files.",
    "Perform a clean OS rebuild; banking trojans establish deep, complex hooks in the browser that are extremely difficult to eradicate manually."
  ],
  "what_to_avoid": [
    "Do not allow the user to access any online banking or financial portals while the machine is infected.",
    "Avoid rebooting the machine before capturing memory, as the critical web-inject configurations and stolen session tokens exist only in RAM."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}