A new campaign targeting Spain and Latin American countries, utilizing the Brazilian stealer Grandoreiro, was detected during March 2025. This report provides detailed insights into the malware’s behavior, along with an explanation of the string obfuscation and decryption techniques employed in this campaign.

Grandoreiro

Grandoreiro is a Brazilian-origin stealer malware that has been active since 2017, primarily targeting Spain and Latin American countries. Its main objective is to steal sensitive information, including banking credentials and personal data. The malware is commonly spread through phishing emails containing malicious attachments or links to fake websites.

Originally focused on Brazilian users, Grandoreiro has expanded its reach globally. It uses advanced evasion techniques to avoid detection, such as encrypting strings with a custom algorithm and employing anti-sandbox measures to hinder automated analysis. Additionally, Grandoreiro can dynamically change its command-and-control (C2) infrastructure based on the victim’s location, making it harder to track.

Grandoreiro continues to pose a significant threat, especially to online banking users, and remains one of the main tools for credential theft in the region.

Description of the campaign

Just as in other related campaigns, Grandoreiro is distributed using phishing emails with attachments containing VBS files.

VBS script inside the malicious attachment.

When the user executes the sample, this will decrypt and install both .exe and .txt files with random name.

Next, the binary will be launched, which will display a window requesting the user to click the “Open” button in order to view the PDF document. Attackers use this technique to require user interaction with the malware and make automatic analysis through sandboxes more difficult.

Once the button is clicked, several checks will be performed to verify that the program is running on a real machine. If it is running in a sandbox, the following message will be displayed on the screen.

Message displayed when Grandoreiro detects running in a sandbox.

The malware will create a mutex with the date of the day it is executed to prevent two instances of the same from running simultaneously.

Then, it checks the geolocation of the device by making a request to the legitimate site ip-api.com. Later, this information will be exfiltrated to the C2 server.

Finally, the service dns.google will be used to obtain the IP address of the domain, and this IP will be used to connect to the C2 instead of the domain.

String Decryption Routine

To hinder analysis, all strings used in the malware are encrypted with a custom algorithm. In particular, Grandoreiro protects various types of strings through encryption, which it will decrypt as part of its operation once it determines that it is not running in a monitored environment. These include: highlighted messages it can use, domains, processes it will check to verify if it is in a sandbox, and other indicators that could be revealing or used in potential detection rules.

The encrypted strings consist of two elements: a key (composed of the first two and last two characters) and the message encoded in base64.

Based on this key, a series of mathematical operations are performed to transform it into an integer that will be used as a seed for a Linear Congruential Generator (LCG), a pseudo-random number generation algorithm. The generated values will be used to permute the string “!@#$%^&*()_+-=[]{}|;:,.<>?”, which will then be concatenated with the string “50600tvc0415” to be used as a password for decrypting the strings using XOR operations.

As a summary, a diagram explaining the string decryption routine is shown below, considering the final decrypted string “Google Chrome” as example.

Diagram showing decryption process (example: Google Chrome)

It is expected that in future campaigns, the decryption routine may vary, as it has in previous campaigns. By following this code, it is possible to decrypt the strings protected by Grandoreiro samples and, in doing so, obtain the IOCs, even if the sample evades the sandbox.

Indicators of Compromise (IoC)

Domains

flightradar.mymediapc[.]net
simpsonsbartmovies.stufftoread[.]com
bayerischemotorenwerke[.]nflfan[.]org
mapfre.homesecuritypc[.]com
renault.hosthampster[.]com
marronfiveshows.serveexchange[.]com
airforce1.mmafan[.]biz
camsobservations.nhlfan[.]net
mercedesbenz.mysecuritycamera[.]net
michaeljacksontribute.mmafan[.]biz

Grandoreiro samples

5bf5697cb0c303d69bf6ac97f6ad5dbad310f28fdf40c7fb9099cc91583935f2
50e3ec3a618b59f503c6a8cdb07c89e8d648101311409a32382652f7f928f514
6dd776c16c704abed1e6ae6ff3848690b5b3e28b4180875238f0c1308f023aac
4bddf4a85a59b41ae693bec7995281f56ba4daf927191bc09a3a4579ffe96630
8fe15db736b045d5c52bfd378c8ca0429d0a13bacc733c0fce01d51abe8266a6
fb5f8192d6f2ca52d91423164db8f405e5c4a4e0cc74bada9292211eec127eac
73b913c046150aeaaf1f3308b7e37fba4fa3b5d792c5dbb8c5890e908b290bd0
05e6706fe3d060dfc1fd480cefd5726caea3e33f4730f339646684af9c279d61
8114064407911492cd9311737500c1019b62d4e81a71d2e1a20ac5114a63f14e
726171f87b348a13975ac9ff8a1eb05a3a13d602da09d7ea8c68f277d97bf67d
01194208095f4d6945a080583cfab1751124c624a57512c32cfdf7fdb696ff39
39fc2a96282e1ab00348a986932e00f06da7413a944ec5f89f96d67c0c207f07
0ce57b80d84893e790f9f10fa717fb324e0950f3ce25fd36b944c547a6f3f1c1
e4a8ee5db0fb4af10ba873f85bc75122956c50fa41b9fc68d07052e16048cce0
574567ab261128f235d52148c907d116cb2f5b19d140d6a50900c786ddb8ac42
8a651d9942c7a2ffd18061cbd2beb0270fa75fce4d843732f3a7e04aa7f066ed
0c76553235c38d616f08cea0e23023bdd8c3b50e553e30273c7de2ec09d48a32
d9df41225ae908270b11f51d92d740cbfc70209179f945ade83cee7d4c523ea8
0b85af6d9a84e4253923f7f79b7ffec7d3050a91830a3f826f1b7bda13fb7327
c2153ab1a1321abb704fd815a2682f83bf6d5b16eb4de126c6c85c5373cb11ac
4a3e98ddce8702d0c680ac316d8edac8cf94a613720d918ef252651051ccccfa
27bfb19e2205709f37b94b5341ec6ea9050092d84c6663ee8cc87b1bb62376a6
623ea30efd9c21026f1a4d3c4eee67bf489effc5bf7f50b331a06e1f164da6e9
b6ccdb7fd20102480ca77a925b46f880ddd7c53a5094b7e48e9bd27afad51fbe
0d7e68f13cbfb94e51c8f17d911723d6aa5694b92153e6b3a2c2423c5fa9a1bb
e8a1e561faaa41fab3b4490b92327998541b9e225a616132c4eaf5f1902d48a9
dc86ef1d816d9e59e47f7c4c663eccc9959a58001128f833230c550c043e8b51
68e389cb7c7c9e53bd32769c480b8e44e7c05381a9899e0bca06ccf1787b3a93
4a6aa3a0e586ea8d2a4e55be90c96cf08b041b6d0fa5b57c66559e3073ef5d0f
3a7e43ab7bd9d7c431540d21c837c8672d57778281d2b3149e58500f63166410
ca0e531114a9f606966e37cc0f3332f891bd7f360b79e3ece8fe392fa7d0a13f
f94b5c9b381e556bcab6f865232d738d39e4733fcd21d3794d1c0ed79ef83b94
272821f02f9e6f8705339ec65f7b53983879d636bcb6b4bf825a974b8289b102
42d079446c0a24b4334cb9c8b72623a75ed7aded959ac38ecd97d098067e4a04
80140052a769ad5f092676c92db6eddef8760d27c90d86127ea8aee0eb00fc43
d98bf95ba605f725c86e0375535dd9617e26e8636973ec4b7f8b6bb4323854e0
f8a99695a5e74844e5e8c75e87803efc76aa8d57640cf6fa712b5d03c64fea38
5b7a8035f90b4091a212eba0ec436584a36c927f71208ac3141311a4a96de6c1
adcb591f08f0fea634d248d2e631c93c65f7ba03bb95fd614bda1e5fa95ae140
fcc19bee18c570a38276fedeaa1a10e66efa2f21751e796ef1e498b0f7fbed31
2a96cf4e7d0bf873760e8082b426f9e1197109c70027cd688453de566fe35851
a0bfbb40f4b6e6fa275b693205c67e338657c7589af5415716500a0b2f588473
0c6d823ed37340809a9d0160bdf9bf5e988d32ab8e7fee1faa1e23d8d4a1dc5d
1f43bb43970e05f79c3abe6f79a428909d1a2f587605979d621345351f2f0bc0
944629e4b9b51cc09a48fdcaeda71c8ee4095bf46439110ab8ef2578c54a12b4
4fba83a8bba564da0bd08f9c120d43694cb5c25657b558a9de440426fffb0cc4
ca7790976ec18a6d9d9fa65d09c933944f5a11ad28afbc5518c3d2880c3f9076
f6ff943fbb0244a8a943fab6dae7e990f12b23f3eb9c2aadec7b531faf070ec9
99ed4df9ec65131974b87dd8fd4a0a782aec3382ab42fe54498c7a992ff03846
4a71a5f71bfc9c8afbe5a5346bcee5d798ff1200bcb33f410082768a44c96ce7
cf7791940dbacfc11474a3ec75fd761cb7d5b02b3b2b5aa4da44f3b737360e69
d440486c79a80fba7a8472298c3fda7e5866b63ed67871c4864040f3384a541e
4d1d80a4b4aae5d93206369775689020ba7dd31426b20d190f44738c61b55099
43e45831d956fa539806b6435b0d10db65d2a443569c02f46f69322b707320ee
e64e22b17b67b7db6e95849f9951ea8f0e9666c7154a53bd9d316aca374a839d
b1554dfaa8f402f5c96c3a0cc8f99198fe68019c55e162c96e983b3bea5e47d2
e9cfce1de32261f4bbb006f9bf56c1f9d453724bc794ecd7ee9a7b3d81d83b63
923f4618105ecf77fca9bca4b2eac1ded8fc58cfe1d0a371dba1710617ece2f1
fe83c4c52bc751b0711e7064056f0a3350d396efd164f3e2a9b01e4984c30418
028a9732e10b240d511eaafdd0deef526647c66abb2101a924f1311079023c5b
77c0dc05bf0882145ed320dc2906c0dd5efa766dbaeacf7c74f05c0472dec4a1
32ad908a32fcb319fb228b9a73f64d691716660281e40d27f432aaddf4566008
56b4058b4535b20cc1c44b274bf57185b8c0f9cc1b42fbf09883cac209711064
26121c26958e8018deb4b2ad3fa10ef6485787d9ad56a0de5fafda89d5efef4f
373087927e758931052139a07294365ac4392809a2e786a3141a728bf0366b3e
ba1db0cd812e3996917a5d53fca6100d97747e691192257e551c51801be6fb07
6aca8b5ad302f53d2adf7bf7d1d50ce9beb978605c0825829be69aa7c6e109ec
78cc0600c65d3556d5897ec90f08bb062782aa8e0b6fef869ad8eacb90ee5fce
04a2a43ae1005d5dcbab6e6749d33e24f52a8ca2f891667462d86d40930db47b
a120c997fff43de7c2d80bb8420fb513d5c4cc25ed551de590516eaa807f6e25
b7df1e956eb9c7f7f7f3db05717b276caba722a158ea01fbaeafac69b078bb0a
0306683cb13e01ae61be5195579bcfbe25cf3b50a3916ef81fe3e2fe8a8f757b
bcb6e044f9c5b0dd1613afe779ef374c215556e408648c163ca9c7e61bd012e1
6a7b619f6da998119f5ad8d2f6173baf101bb063f44cbe3487ed8f3c67f60e8d
c90c4822a1ada276a92ae92ac2c9e5e5a2241ef0e1955d472e82244b05de7b40
a48956714ad8e26b407eb684521ceb3052488fba956119583ec948483f3dce2e
e57bdfa8dcd5d8d67636dc3a0f8b64b30887d740c45dfe06952f068276305154
22f95266c3e7ff1987ea5bba815c294b424f039261aa85b397e1326ee8d627ee
4b3fcb0697c76e227f5461637bb804ca00630fd73182f1c55a7cef88bb0b4529
28ac45c1c68f846378ca097904029c19bb3d0e044bc28f2d5f91984a9dd390bc
def88a0ce4de231415c91131a9e47583e0197d1367b026966230852d9bb24f47
6781fd694160090ee43c11d0b29d94dc84b8c399e610d4947fafde5c9744cd57
6cd92847b4ad57f42aa97dfcf055f1d0a4242ced55a197b3d21fd08366eeb155
91f912195e3d1d226697a498f322c112b6bfc2650a4fa23f7e975e7e08200c2b
7ac40f86d76d72a9a489a78317517cfe99e7cd47739b08b8144ff9b9c4fe0d7e
eb78679176cfb8fb34f0088e36eca23643bece992d92ee8270403199e8e24858
59e1edeab48031cc98720d10734ad4147a13bcc8cc8a924fa15d73c8dae368fe
b050e84ec408e43bae67a4624f95b1594022e79c7a8ee745dd7d36ed2eb2a397
f810650e0735b8261f9ff7c76ac27380f561591c54932740bd5755383f56d57e
7cf7c9f8c05aeee52273c6571cc55d375c44ffe3597d0ce9770f76db12d873d9
401960841f1fe7ce21b6fdadac696d5c350e963560f5038ff02958b364e1b6d6
4856d592f80e83e841e057b95dc30b2fc901716228644eae5280fd5595c1faca
9691f4b9c935f0452d409cf755f3ddad343d8695316f8da9595b64dd32181a04
11bf5f21e6ada8d11d4abe1c734597307c871a551f6812015da70abc7b00af37
55e785fc38e102d615d9eb764b1842df851cb3e873bc1231c9eac78f16a6860a
a90017c28771eac8890483005c955b1d29cf0199c24d1d4992c8b843ff2496dc
6b117f8bc5a27e4f7cf48d0302c715a8f08e77fe87626fe1121bc97a699c125a
604c958c40a3e1630fa8a596b97e5294286ffa967dbe6136eb28bd7b98c203fa
e265d06735e97ed021731f4d4163e13ce11bf572b44a1a4318cd22671d7efc9c
c2426555fff31e2b13ca3e33d2c43f1ba63dc73bb1f35a350a7cdfc983c2dff3
9e1cf99f286827c3f03d4f15e81465080133589e0b75128ac19a7f961fef268e
a4cf0d16e83b5b9cdca99d0423488a46e5181b5377b8dc39d8d94d80e2c77e60
5ac1f0a97bc072b98df34a2a5be7fa2bec284f07c037825772cc807d7bd30476
489cbf0ed2df2871d265b72e049240dbb6af527f46fd8a75056cbaf5dd2426ff
ee03224052cb97c88756ac1ec7f1e63d62129b35189023ee21c76b0a0d92430b
edad942ce90dc32a2f87a8b365e8a3ba409d663331df20fca37cf0ff1e51d42e
b4152dd07bb8ce7786c3af03b24f55eda307e2bb1901d688678fc2fd91fbf680
28f130cc253d8b1cd95479143e9b0819eb1f2744097a996c41b82a1851206068
faf61c2e91e923422fb6b9330019044261d51e6d05e4a775496c8f23cf511bab
9330f7fa5d7cc25c0b61ab0385fed96f0fdb93418ed6befb488fe616c4b1a2f7
5338f216297da245971b68948a3002519e0d38f6e9138dc4be9a50deb377ef58
c6708cad7ee1bf37f657dc57b331fe56b551205f9465f1002bcbf36a649a78bc
6ff42b85d2b9745c6d4edcfc129a522690627aa7a66c4540a899538e5cf3b34e
dc847be4793c40e215346f40b7a9f9788f1d2a506050cecb05789db5dbb622dc
35fab0249511025af18f2bf33a29bf2be23507c9c5000f9b5fa26cd57ac5bffb
7b671eb157d4126f8818ea2cba39ecf7922acddbfe213a190b393023befdeffd
ca219abfd00bca589699613004fea91105be3b59c941fce7029c38ed6055e407
526a9ceaff2ee12ea7cd6c1ec0c9ef31a9f5c7ec6a65fab66114826d43920f77
198e817151db9b44f5f879135aa1d42285e8b04e573308f05fc47c5915a9186b
edd42a8b9de916efdaafd4556020dd5ef77800bed2951f847e9ff89fb8255191
99e41a43c22b65a019c22e624f34e46588ba513e4bff3a7bb23464d866a9830c
e738bca5cc1d0c635af58adbb1ceb319275247672f4fe8a9a3384e3944f8c9eb
1c45b6066c93e1ae03292655d558e1ca828f4c43e1af2c1a9be6663d8c21f7f5
b2462d3bcc0b2019f547cf3dab119e9e2a3fb362e83ec52bc4530fa7388fa26e
31f1ea68dcebd08db98383579d33a46fcf55026fbb73a0bc8a69ed28e48d9cfe
643db9eee1f71cce4dd4e27ae5687c93c85e91baa18e47127074f609add1f0a1
8a4c7895114c65d9174ae744aeff93024214d9bbc76cafd3e9f21ffbce8efdf4
7913c40a5a616b15a4e89375bd084508d066ca47fd7553fa1a0a99128e09e5a4
a3e15bdd4b8406972a31aed4106a8801c6fdec4521a301e5a282cd9f90762c51
386da5129932cff17210ff8e635c6d03d371e01a94c6e494fa1c237066f86289
ae471e8035d65784507dcb6ff5a1904a571664a33334962927aa6d6a190d7f57
5a048decf04b6961fda70dd97fb35bbc87a737c83167159efb67f51af67988ea
3fdf982d21e8ccd6ba6e955543d3d2f9d370044ac7d6a9acc50b9d3223ef899b
787f69def34bc27b75faf847a5f46b29dd5ef8fdee4038308a7561b08186b6e3
ca9a589968ebbbdf3b5e22fafdf2b710bf0f301f88c39eb1865b900386fcd4a2
20e3c6baf50adb0ae00d83a146d0e28b6d0a282f311f7240873e00fc89e65b97
245cfab9d4f55115663456493d11ca4449c00e1866f2efcad9b3b056ac30fd96
b76724f885aa00040050806d37f1603439868f9d8fb7329a38db0948b1075641
b8d742e12ab2dce7306caea26ac647b00aa66c5714c4c84524d0d7e35c9c63c6
96c5f31b62af94896fd7aa7dfee7e2a13c7d75bf046b3e9a174feed99bef94cb
77df78fdbea093bbc8c347db772f13001b6ff443a5b423764040278249bb313d
ee507459cfacf5c0fdb84bebbe410eb9a7ed52a8089e59ea986bfc529e5ad1c1
3767b4501f767e5b7ae41602c28254bc3a57d6db26d94e588932248d8b61cd5d
68f92ec77258d0a3d4570d4b70a2743cbe99f64329488c518e05414c54ab2c3a
67ff327124e9197224f027f381640d10b89a23605276f9840c388622982b9492
a3caa47ab11f0bf78341d600f3881c4a8c81afe3e6996712f434b7ee73d61f0f
d23577500aa01105387eee9d1354a5a2830932c7fb801c72aa6df37d78ee1c8a
77bc4990e07dfbe45e8ba400b8825f9bfe876e31abfb037168c7dca9cc84f9ce
7b869ee1fb74b9953af0b843094f9dbc35e0a05c02341e5ceede1c4647543c95
193feb2a4e26c12f4bb4f00faf92eff926fd4fd4aa27a7e3dfac1858f1b1ff6d
a4e8aa05093429861824831ce3e708db9cbf3721d791b9b08b45a3b807342811
79840c1ca146c7bb0263a9ca78e78dd502c3ef8071af3f35366b6c6707b2f4d2
70f44232131fe4bfa584a4fe801e060bd5cec7c8c7c62f77ae077561e75c057d
ca040852f6b973f8846f6cca00a60abb264a46c459d5290be3e2206f6d80690a
9ae358cc488b1bc478652ec84e498f118f8f9a1f3140be268c94658740f42c90
172d42802482d507e8f6683f6ffb825071d66f3c1258e92943db27b0f801ecf0
afa5fd76d35dd641148a38eb8ccd5260696566c27cf42f980bf933012fd53f0b
89e907f3a48b3e837547e01d0528ef106aa38bb4ce287e2cf927dc98a39f5501
35379d795201b58b50db071953f6b33b80d34493673435e132efc8eb272bc0e1
6664cb0180449f0232342e271afd7db8464c00ca268cf6a1b269bdcfec5cb56a
da320410b5407d29f8a150e5e598b1181fa3a4238e20e9eec4f5048ce050e43d
043a76713890dedadd97ee677801b0d0e3a16535107eb59fce34d85df5176106
c1d240eaa0fcf0b8c4c4432309227ecc980da7e2db0eaba1659e222591922f50
0fc38ff1367aca70a85d99a9580ec25e3c6b170418ef57282c4ffd2b086984cc
d6e823fa5d81b3878f04bcbaf4fad22279bc8e8c872a3f77323caf265a282c43
97535f4957224ab823fa9ea33852f7913e4de4455f1a02547dbdabafc1d30117
c140bab429fca3468a9c4626e37b2e65bb9ddf7438e8892becf620bf0d405040
b7fcbfec6614c09882654c1b5be9463137ba0aa21dae1eacbaa306646c7d465d
f9b235dc0d3d63304f455d303c01c81d47aed3235978dc467235f1b94c59e34a
9c99747edf4d3e14fd6d9634d70429cbf2f02c6134db4a2ccfce33e604b04bb4
0da07060be36789488086e9c09fcf2dc0df6da4ffa1171b3da9cb8d366cf6ac3
bd6984b746a0a88fd4bc985b5c7ff08584d96ff67c193bbe8e1cacefa3205a2c
af42a4172bb41d6b504b433e19ed4ef4d30b639ed7d2cec592982a51678b8e1c
03c813f6416ddbda74aa1eb10b3314bcf614be8ca62405b680fbb84bbedbc640
3b9326585b7019a1fa87c8a14fbb104c97b2ecf0b46a882c8cf8538a98fb6488
42ef95f21dc4ea3c610593f8cd9fc6364aa849acf3fef3b70d54f2bbeb7a382c
e1b8314e9a34326d2fe4b0764def77076cac41e3affa58784d0a96b3497a4499
f4c7fb8ac578446e41722c236c3a123dcac599a440c69e46595e01fc4f204f47
ab0c75dd6d7159b18cfe38e751883c0c6d0f34b1c5962849ec6076bc84e31456
3b0b691496855553218ef6135c79043b693c2914d53e25ae7ec9d6d239d994bd
d80760d920950c10c90b2f8cab9f206e7225a71e1618bdd2a6d3e357c22fbc5e
1b67637f9b9a7e8195bedb9bceacd76303e4b897cfc7e42995bfc9c940505ae5
e4f6626a4bd1f26486fa3c94691b5ce73d477517059363dc231b6f90a8be2874
10a06f9117dff59032483023bc46dfaf96cae24fd9937ba88b80817349bfe631
05bc91c076049c1cedbd9f742cb168b0b951521ebac660822786fab6830e92b3
c688682c5f0e3c920f03cf84fab6d407b345000ee17380f8a8669d2f08ae11e4
4f4dca0efaedeedb9ae9289770bd0e865b2cd3fb91eadce041590a2f3c09524e
df9a099b6e5fe8b847a41d1c36a271aad63bd15b120cef38fefb6e068a0e5f55
94d28300ce41bf60b9f231e5fb5b82d76f084012bc5917c77e332908f514969c
f8dbaf0fbcaa27d782b25802573d0d029ef76ca4cbac97e2a0d4c0c586c5071b
d4757c94cb65748af7f566b3e1cdf0109d205ef5455ef8c612b77960a103b92b
e17cfa4939ac30f741ea6fbdf982bd6a759836e12329d2375685b9fd22579d84
07f275a27e36c4d347257449de79dab241ecee7e45186d57d0081c42f22d4230
b0f6e2f453453bf7b87e950fd1d63c7b7901dd004cf75c6762780b2052f182d8
7f2fd97dbf9e98f2b4eeed330630fdd4a3e26f06909f01987de58515f43cdeae
2a470979ac47339885b08cee096fb4896ea1b1bfccc80d19e19c9a61e546fc6d