Bancteian

Overview

Trojan:Win32/Bancteian is a stealthy, targeted banking trojan engineered to quietly infiltrate endpoints, monitor user browsing activity, and harvest sensitive financial credentials through the use of localized web-injects and keylogging.

Understanding Bancteian
To the victim, a Bancteian infection is entirely invisible until fraudulent transactions appear on their bank statements. For threat intelligence analysts, Bancteian represents a specialized financial threat. Unlike noisy adware, Bancteian is designed for maximum stealth. Its primary objective is to lay dormant until the victim navigates to a targeted banking or financial portal, at which point it activates to steal credentials and bypass Two-Factor Authentication (2FA).

Execution and Evasion Strategies
Bancteian is typically distributed via targeted spearphishing campaigns masquerading as invoices or shipping documents, containing malicious macros or exploit code. Upon execution, it utilizes heavy packing and obfuscation to evade static AV. It establishes persistence via Registry Run keys and injects its core monitoring DLL into the web browser processes (`chrome.exe`, `iexplore.exe`). When the user visits a targeted bank, Bancteian utilizes 'Man-in-the-Browser' (MitB) techniques, seamlessly injecting malicious HTML/JavaScript into the legitimate banking page to request additional information (like ATM PINs or 2FA tokens) directly from the user.

Indicators of Compromise & Impact
The impact is immediate, catastrophic financial loss. Threat hunters should investigate EDR alerts for 'Browser Process Injection' or 'Suspicious API Hooking'. Network logs will reveal Bancteian reaching out to custom C2 infrastructure to download updated web-inject configuration files. Memory forensics is critical to extract the injected Bancteian DLLs and analyze the localized target lists (the specific banks the trojan is programmed to attack).

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.004: Monitor for unauthorized keylogging, screen capturing, or web browser API hooking. Deploy EDR to detect API hooking.
• T1185: Enforce strong MFA and use browser isolation or hardened browsers for sensitive financial or administrative portals to defeat session hijacking.
• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_BANCTEIAN {
    meta:
        description = "Detects Bancteian (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "bancteian" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Bancteian Activity
id: 108553d74d57a234b4f6775af1412454
status: experimental
description: Detects generic indicators of the bancteian malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*bancteian*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the endpoint from the network to halt the active exfiltration of banking credentials and prevent interactive MitB sessions.
2. Assist the user in immediately contacting their financial institutions to freeze accounts, block recent transactions, and reset all passwords.
3. Capture a live memory image (RAM dump) to extract the injected Bancteian DLLs and the downloaded web-inject configuration files.
4. Perform a clean OS rebuild; banking trojans establish deep, complex hooks in the browser that are extremely difficult to eradicate manually.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not allow the user to access any online banking or financial portals while the machine is infected.
2. Avoid rebooting the machine before capturing memory, as the critical web-inject configurations and stolen session tokens exist only in RAM.

References & External Analysis

• Search "bancteian" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Gametool
• Mansabo
• Lsslogger
• Runbooster
• Termite

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/bancteian.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.