Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
Inside Brazil’s Financial Malware Ecosystem: Deep Dive into the Eternidade Stealer
Excerpt
This post is the first analysis in a trilogy that I will be producing over the coming weeks and months. In it, I will conduct an in-depth examination of the infection chains and the Brazilian banking malware ecosystem , specifically Eternidade Stealer , Astaroth , and Grandoreiro , that were observed in operation during the same period ( the first or second half of 2026 ). The goal of this trilogy is to provide the community with a comprehensive technical knowledge regarding…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | caee37ada944021465739c1ac2f932c76e202769070e2f92a7da452106a313a0 | Medium | Score 53/100 | First seen |
| Domain | imap.terra.com.br | High | Score 58/100 | First seen |
| Domain | secretonow.site | High | Score 58/100 | First seen |
| SHA256 | 1b2c3e80347b35fb5811619f3aeae75f05dd4e635ffef7620141be7ed3041eb3 | Medium | Score 53/100 | First seen |
| SHA256 | b78ebc306f33c9eec1270310a834b4076f4c77c2683c7f4a9fd63d330f70e224 | High | Score 85/100 | First seen |
IOC Relationship Graph
Building graph…