Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
19 IOCs
TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook
Threat Actors
Excerpt
Elastic Security Labs identified a new Brazilian banking trojan that we are tracking as TCLBANKER, a malware family we assess is a major update of the MAVERICK / SORVEPOTEL family. The campaign, tracked as REF3076, features a loader with robust anti-analysis capabilities that deploys two embedded .NET Reactor-protected modules: a full-featured banking trojan and a worm module for self-propagation. The banking trojan monitors the victim's browser address bar via UI Automation,…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →19 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | https://documents.ef971a42.workers.dev/file | High | Score 58/100 | First seen |
| Domain | doccompartilhe.com | High | Score 58/100 | First seen |
| Domain | pages.dev | High | Score 80/100 | First seen |
| SHA256 | 8a174aa70a4396547045aef6c69eb0259bae1706880f4375af71085eeb537059 | Medium | Score 53/100 | First seen |
| SHA256 | 668f932433a24bbae89d60b24eee4a24808fc741f62c5a3043bb7c9152342f40 | Medium | Score 53/100 | First seen |
| URL | https://campanha1-api.ef971a42.workers.dev/api/installs | High | Score 58/100 | First seen |
| Domain | worker.dev | High | Score 58/100 | First seen |
| IP | 191.96.224.96 | High | Score 58/100 | First seen |
| Domain | saogeraldoshiping.com | High | Score 58/100 | First seen |
| SHA256 | 701d51b7be8b034c860bf97847bd59a87dca8481c4625328813746964995b626 | High | Score 72/100 | First seen |
| Domain | documentos-online.com | High | Score 58/100 | First seen |
| URL | https://arquivos-omie.com | High | Score 58/100 | First seen |
| Domain | recebamais.com | High | Score 58/100 | First seen |
| Domain | web.whatsapp.com | Low | Score 30/100 | First seen |
| URL | wss://mxtestacionamentos.com/ws | High | Score 58/100 | First seen |
| Domain | afonsoferragista.com | High | Score 58/100 | First seen |
| URL | https://campanha1-api.ef971a42.workers.dev/api/campaign | High | Score 58/100 | First seen |
| SHA1 | 91fafaa1240676afe5c55d931261e3798797c408 | Medium | Score 53/100 | First seen |
| SHA256 | 63beb7372098c03baab77e0dfc8e5dca5e0a7420f382708a4df79bed2d900394 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…