Skip to main content
IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Exposure
5 IOCs

Inside Brazil’s Financial Malware Ecosystem: Deep Dive into the Eternidade Stealer

0x0d4y Malware Research
0x0d4y Malware Research
Published October 21, 2026Original Report

Excerpt

This post is the first analysis in a trilogy that I will be producing over the coming weeks and months. In it, I will conduct an in-depth examination of the infection chains and the Brazilian banking malware ecosystem , specifically Eternidade Stealer , Astaroth , and Grandoreiro , that were observed in operation during the same period ( the first or second half of 2026 ). The goal of this trilogy is to provide the community with a comprehensive technical knowledge regarding…

Read the original report →

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYunknownINFRASTRUCTUREimap.terra.com.brsecretonow.siteCAPABILITYunknownVICTIMunknown
Adversary
Infrastructure(2)
Capability
Victim

Indicators of Compromise

Open the mindmap →

5 indicators

TypeIndicatorConfidenceScoreFirst Seen
SHA256caee37ada944021465739c1ac2f932c76e202769070e2f92a7da452106a313a0MediumScore 53/100First seen
Domainimap.terra.com.brHighScore 58/100First seen
Domainsecretonow.siteHighScore 58/100First seen
SHA2561b2c3e80347b35fb5811619f3aeae75f05dd4e635ffef7620141be7ed3041eb3MediumScore 53/100First seen
SHA256b78ebc306f33c9eec1270310a834b4076f4c77c2683c7f4a9fd63d330f70e224HighScore 85/100First seen

IOC Relationship Graph

Building graph…