{
  "family": "casbaneiro",
  "sample_count": 10,
  "category": "trojan",
  "description": "Trojan:Win32/Casbaneiro (also known as Metamorfo) is a prominent, highly active Latin American banking trojan that primarily targets financial institutions and users in Brazil and Mexico. It is notorious for its heavy reliance on social engineering, displaying convincing fake pop-up windows to steal credentials, and its highly unusual methods of hiding its Command and Control (C2) infrastructure within legitimate cloud services.<br><br><b>Understanding Casbaneiro</b><br>To an infected user, the malware operates silently in the background until they attempt to visit a targeted banking website. Suddenly, a perfectly replicated, uncloseable pop-up window appears, demanding their two-factor authentication (2FA) token or credit card details. For security analysts, Casbaneiro is a fascinating study in regional cybercrime. It rarely relies on sophisticated exploits; instead, it uses massive, localized spam campaigns and highly evasive C2 routing to maintain its botnet.<br><br><b>Execution and Evasion Strategies</b><br>Casbaneiro is almost exclusively distributed via malspam (`T1566.001`), often disguised as invoices, tax documents, or airline tickets relevant to Latin American users. The initial dropper is usually a VBScript or PowerShell script hidden inside a ZIP or MSI file (`T1059.001`). Upon execution, it establishes persistence via Registry Run keys (`T1547.001`) and heavily obfuscates its final payload. Uniquely, Casbaneiro is famous for hiding its C2 server IP addresses encrypted within the descriptions of random YouTube videos, GitHub repositories, or Pastebin posts (`T1102.001`). This 'Dead Drop Resolver' technique allows it to bypass traditional DNS blacklists. Once active, it monitors the active window title (`T1056.004`). If it detects a target bank, it injects an invisible overlay or a fake pop-up window (`T1566.002`) to steal credentials, which are immediately sent back to the attackers.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is direct financial theft. EDR logs will often show anomalous PowerShell execution originating from a downloaded archive. Network analysts should look for the endpoint making unusual HTTP requests to YouTube APIs or Pastebin immediately after startup, followed by encrypted traffic (often on non-standard ports) to an unknown IP address. The presence of large, encrypted payloads masquerading as legitimate DLLs in the `%AppData%` folder is a strong host-based IoC.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.002",
    "T1547.001",
    "T1059.001",
    "T1102.001",
    "T1056.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1102.001",
      "name": "Web Service: Dead Drop Resolver (Using YouTube/GitHub for C2 routing)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1566.002",
      "name": "Phishing: Spearphishing Link (Fake Banking Pop-ups)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1056.004",
      "name": "Input Capture: Credential API Hooking (Monitoring Window Titles)",
      "tactic": "Collection"
    },
    {
      "id": "T1059.001",
      "name": "Command and Scripting Interpreter: PowerShell (Initial Dropper)",
      "tactic": "Execution"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately upon detecting the anomalous PowerShell execution or the 'Dead Drop Resolver' network traffic.",
    "Enforce a mandatory password reset for all financial accounts and internal portals accessed from the infected machine, as the overlay attacks are highly effective.",
    "Analyze the PowerShell dropper to extract the specific YouTube URL or Pastebin link used for C2 routing; block the resolved IP address at the firewall.",
    "Perform a deep forensic scan to locate and remove the heavily obfuscated DLL payloads hidden in the user profile directory."
  ],
  "what_to_avoid": [
    "Do not assume the infection is standard adware; Casbaneiro's overlays are specifically designed to steal high-value banking credentials.",
    "Avoid relying solely on DNS blacklists, as the Dead Drop Resolver technique completely bypasses them."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}