Amavaldo

Overview

Trojan:Win32/Amavaldo is a highly sophisticated banking trojan known for its complex, multi-stage infection chain and its specific geographic targeting (frequently focusing on users and financial institutions in Brazil and Latin America). Amavaldo is designed to steal banking credentials, intercept two-factor authentication (MFA) codes, and allow attackers to perform fraudulent transactions while the victim is actively logged in.

Understanding Amavaldo
To a victim, an Amavaldo infection is invisible until money is missing from their accounts or they are presented with a highly realistic, full-screen fake banking login page that prevents them from doing anything else until they enter their credentials. For a financial institution, it represents a critical threat capable of defeating standard anti-fraud measures.

Execution and Web Injection Mechanics
Amavaldo relies heavily on spear-phishing emails containing malicious MSI installers or VBScript droppers hidden inside ZIP archives (`T1566.001`). The infection chain is notably complex, often using legitimate dual-use tools (like PowerShell or certutil) to download subsequent stages, heavily utilizing 'Living off the Land' (LotL) tactics (`T1059.001`). Once the final payload is running, it achieves persistence (`T1547.001`) and embeds itself into web browsers. When the victim navigates to a targeted banking URL, Amavaldo uses advanced 'Web Injects' and overlay screens (`T1185`) to dynamically alter the bank's page, capturing keystrokes and MFA tokens, and sending them directly to the attacker's C2 server (`T1071.001`).

Indicators of Compromise & Impact
The impact is direct, massive financial theft. Host-based IoCs include EDR alerts for `msiexec.exe` or `wscript.exe` downloading payloads from unusual, randomly generated URLs. The presence of heavily obfuscated scripts in the `%AppData%` directory is common. Network IoCs include the downloading of 'web inject' configuration files and outbound communication to C2 panels.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1059.001: Restrict execution of PowerShell. Enforce PowerShell Constrained Language Mode and Script Block Logging.
• T1185: Enforce strong MFA and use browser isolation or hardened browsers for sensitive financial or administrative portals to defeat session hijacking.
• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_AMAVALDO {
    meta:
        description = "Detects Amavaldo (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "amavaldo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Amavaldo Activity
id: 571bc28335340dd629086ce70d144b02
status: experimental
description: Detects generic indicators of the amavaldo malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*amavaldo*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the endpoint from the network to sever the C2 connection and prevent the attacker from initiating fraudulent transactions.
2. Contact the victim's financial institutions immediately to freeze accounts and alert them to the high probability of a Man-in-the-Browser compromise.
3. Assume all web credentials stored on or entered into the machine have been stolen, and mandate enterprise-wide password resets.
4. Analyze the entire complex infection chain (VBScript -> PowerShell -> Payload) to identify all dropped artifacts for complete removal.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not rely on standard MFA (like SMS codes) to protect accounts if Amavaldo is suspected, as the attacker is actively intercepting those codes via the overlay.
2. Avoid simply running an AV scan and leaving the machine online; banking trojans require a complete wipe and reimage to ensure the deep API hooks are removed.

References & External Analysis

• Search "amavaldo" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Zepfod
• Goobzo
• Oepass
• Jacksbot
• Xrat

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/amavaldo.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.