Casbaneiro

Overview

Trojan:Win32/Casbaneiro (also known as Metamorfo) is a prominent, highly active Latin American banking trojan that primarily targets financial institutions and users in Brazil and Mexico. It is notorious for its heavy reliance on social engineering, displaying convincing fake pop-up windows to steal credentials, and its highly unusual methods of hiding its Command and Control (C2) infrastructure within legitimate cloud services.

Understanding Casbaneiro
To an infected user, the malware operates silently in the background until they attempt to visit a targeted banking website. Suddenly, a perfectly replicated, uncloseable pop-up window appears, demanding their two-factor authentication (2FA) token or credit card details. For security analysts, Casbaneiro is a fascinating study in regional cybercrime. It rarely relies on sophisticated exploits; instead, it uses massive, localized spam campaigns and highly evasive C2 routing to maintain its botnet.

Execution and Evasion Strategies
Casbaneiro is almost exclusively distributed via malspam (`T1566.001`), often disguised as invoices, tax documents, or airline tickets relevant to Latin American users. The initial dropper is usually a VBScript or PowerShell script hidden inside a ZIP or MSI file (`T1059.001`). Upon execution, it establishes persistence via Registry Run keys (`T1547.001`) and heavily obfuscates its final payload. Uniquely, Casbaneiro is famous for hiding its C2 server IP addresses encrypted within the descriptions of random YouTube videos, GitHub repositories, or Pastebin posts (`T1102.001`). This 'Dead Drop Resolver' technique allows it to bypass traditional DNS blacklists. Once active, it monitors the active window title (`T1056.004`). If it detects a target bank, it injects an invisible overlay or a fake pop-up window (`T1566.002`) to steal credentials, which are immediately sent back to the attackers.

Indicators of Compromise & Impact
The impact is direct financial theft. EDR logs will often show anomalous PowerShell execution originating from a downloaded archive. Network analysts should look for the endpoint making unusual HTTP requests to YouTube APIs or Pastebin immediately after startup, followed by encrypted traffic (often on non-standard ports) to an unknown IP address. The presence of large, encrypted payloads masquerading as legitimate DLLs in the `%AppData%` folder is a strong host-based IoC.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.004: Monitor for unauthorized keylogging, screen capturing, or web browser API hooking. Deploy EDR to detect API hooking.
• T1059.001: Restrict execution of PowerShell. Enforce PowerShell Constrained Language Mode and Script Block Logging.
• T1566.002: Inspect email links for known malicious domains and use link-rewriting services for time-of-click analysis.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_CASBANEIRO {
    meta:
        description = "Detects Casbaneiro (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "casbaneiro" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Casbaneiro Activity
id: b29d3763913beccd63c29408c7937baf
status: experimental
description: Detects generic indicators of the casbaneiro malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*casbaneiro*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint immediately upon detecting the anomalous PowerShell execution or the 'Dead Drop Resolver' network traffic.
2. Enforce a mandatory password reset for all financial accounts and internal portals accessed from the infected machine, as the overlay attacks are highly effective.
3. Analyze the PowerShell dropper to extract the specific YouTube URL or Pastebin link used for C2 routing; block the resolved IP address at the firewall.
4. Perform a deep forensic scan to locate and remove the heavily obfuscated DLL payloads hidden in the user profile directory.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the infection is standard adware; Casbaneiro's overlays are specifically designed to steal high-value banking credentials.
2. Avoid relying solely on DNS blacklists, as the Dead Drop Resolver technique completely bypasses them.

References & External Analysis

• Search "casbaneiro" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• A8P9Eklc
• Uiwao0Sam
• Proxyagent
• Dynamer
• Dnschanger

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/casbaneiro.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.