ESET Grandoreiro April 2020

Grandoreiro can identify installed security tools based on window names.

Grandoreiro can determine the IP and physical location of the compromised host via IPinfo.

Grandoreiro has added BMP images to the resources section of its Portable Executable (PE) file increasing each binary to at least 300MB in size.

Grandoreiro can store its configuration in the Registry at `HKCU\Software\` under frequently changing names including %USERNAME% and ToolTech-RM.

The Grandoreiro payload has been delivered encrypted with a custom XOR-based algorithm and also as a base64-encoded ZIP file.

Grandoreiro can collect the username from the victim's machine.

Grandoreiro has named malicious browser extensions and update files to appear legitimate.

Grandoreiro can send data it retrieves to the C2 server.

Grandoreiro can log keystrokes on the victim's machine.

Grandoreiro can identify installed security tools based on process names.

Grandoreiro can use VBScript to execute malicious code.

Grandoreiro can delete .LNK files created in the Startup folder.

Grandoreiro has the ability to use HTTP in C2 communications.

Grandoreiro can collect the computer name and OS version from a compromised host.

Grandoreiro can parse Outlook .pst files to extract e-mail addresses.

Grandoreiro can utilize web services including Google sites to send and receive C2 data.

Grandoreiro can download its second stage from a hardcoded URL within the loader's code.

Grandoreiro can execute through the WinExec API.

Grandoreiro can modify the Registry to store its configuration at `HKCU\Software\` under frequently changing names including %USERNAME% and ToolTech-RM.

Grandoreiro can determine the time on the victim machine via IPinfo.

Grandoreiro can decrypt its encrypted internal strings.

Grandoreiro can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.

Grandoreiro has used malicious links to gain execution on victim machines.

Grandoreiro can modify the binary ACL to prevent security tools from running.

Grandoreiro can detect VMWare via its I/O port and Virtual PC via the vpcext instruction.

Grandoreiro can list installed security products including the Trusteer and Diebold Warsaw GAS Tecnologia online banking protections.

Grandoreiro can use run keys and create link files in the startup folder for persistence.

Grandoreiro can bypass UAC by registering as the default handler for .MSC files.

Grandoreiro can steal cookie data and credentials from Google Chrome.

Grandoreiro has been spread via malicious links embedded in e-mails.

Grandoreiro can use a DGA for hiding C2 addresses, including use of an algorithm with a user-specific key that changes daily.

Grandoreiro can hook APIs, kill processes, break file system paths, and change ACLs to prevent security tools from running.

Grandoreiro can block the Deibold Warsaw GAS Tecnologia security tool at the firewall level.

Grandoreiro can block the Deibold Warsaw GAS Tecnologia security tool at the firewall level.