{"id":2805,"date":"2025-04-04T10:24:12","date_gmt":"2025-04-04T08:24:12","guid":{"rendered":"https:\/\/lab52.io\/blog\/?p=2805"},"modified":"2025-04-04T10:58:19","modified_gmt":"2025-04-04T08:58:19","slug":"2805-2","status":"publish","type":"post","link":"https:\/\/lab52.io\/blog\/2805-2\/","title":{"rendered":"Grandoreiro Stealer Targeting Spain and Latin America: Malware Analysis and Decryption Insights"},"content":{"rendered":"\n

A new campaign targeting Spain and Latin American countries, utilizing the Brazilian stealer Grandoreiro, was detected during March 2025. This report provides detailed insights into the malware’s behavior, along with an explanation of the string obfuscation and decryption techniques employed in this campaign.<\/p>\n\n\n\n

Grandoreiro<\/h1>\n\n\n\n

Grandoreiro is a Brazilian-origin stealer malware<\/strong> that has been active since 2017, primarily targeting Spain<\/strong> and Latin American countries<\/strong>. Its main objective is to steal sensitive information, including banking credentials and personal data. The malware is commonly spread through phishing emails<\/strong> containing malicious attachments or links to fake websites.<\/p>\n\n\n\n

Originally focused on Brazilian users, Grandoreiro has expanded its reach globally. It uses advanced evasion techniques<\/strong> to avoid detection, such as encrypting strings with a custom algorithm and employing anti-sandbox<\/strong> measures to hinder automated analysis. Additionally, Grandoreiro can dynamically change its command-and-control (C2)<\/strong> infrastructure based on the victim’s location, making it harder to track.<\/p>\n\n\n\n

Grandoreiro continues to pose a significant threat, especially to online banking<\/strong> users, and remains one of the main tools for credential theft<\/strong> in the region.<\/p>\n\n\n\n

Description of the campaign<\/h1>\n\n\n\n

Just as in other related campaigns, Grandoreiro is distributed using phishing emails with attachments containing VBS files.<\/p>\n\n\n

\n
\"\"
VBS script inside the malicious attachment.<\/figcaption><\/figure><\/div>\n\n\n

When the user executes the sample, this will decrypt and install both .exe and .txt files with random name.<\/p>\n\n\n

\n
\"\"
Files created by the malware.<\/figcaption><\/figure><\/div>\n\n\n

Next, the binary will be launched, which will display a window requesting the user to click the “Open” button in order to view the PDF document. Attackers use this technique to require user interaction with the malware and make automatic analysis through sandboxes more difficult.<\/p>\n\n\n

\n
\"\"
Window displayed by the malware.<\/figcaption><\/figure><\/div>\n\n\n

Once the button is clicked, several checks will be performed to verify that the program is running on a real machine. If it is running in a sandbox, the following message will be displayed on the screen.<\/p>\n\n\n

\n
\"\"
Message displayed when Grandoreiro detects running in a sandbox.<\/figcaption><\/figure><\/div>\n\n\n

The malware will create a mutex with the date of the day it is executed to prevent two instances of the same from running simultaneously.<\/p>\n\n\n

\n
\"\"
Mutex created with current date<\/figcaption><\/figure><\/div>\n\n\n

Then, it checks the geolocation of the device by making a request to the legitimate site ip-api.com<\/strong>. Later, this information will be exfiltrated to the C2 server.<\/p>\n\n\n

\n
\"\"
Use of ip-api.com.<\/figcaption><\/figure><\/div>\n\n\n

Finally, the service dns.google<\/strong> will be used to obtain the IP address of the domain, and this IP will be used to connect to the C2 instead of the domain.<\/p>\n\n\n

\n
\"\"
Use of dns.google.<\/figcaption><\/figure><\/div>\n\n\n

String Decryption Routine<\/h1>\n\n\n\n

To hinder analysis, all strings used in the malware are encrypted with a custom algorithm<\/strong>. In particular, Grandoreiro protects various types of strings through encryption, which it will decrypt as part of its operation once it determines that it is not running in a monitored environment. These include: highlighted messages it can use, domains, processes it will check to verify if it is in a sandbox, and other indicators that could be revealing or used in potential detection rules.<\/p>\n\n\n\n

The encrypted strings consist of two elements: a key (composed of the first two and last two characters) and the message encoded in base64.<\/p>\n\n\n

\n
\"\"
String decryption routine.<\/figcaption><\/figure><\/div>\n\n\n

Based on this key, a series of mathematical operations are performed to transform it into an integer that will be used as a seed for a Linear Congruential Generator (LCG), a pseudo-random number generation algorithm. The generated values will be used to permute the string “!@#$%^&*()_+-=[]{}|;:,.<>?”<\/strong>, which will then be concatenated with the string “50600tvc0415”<\/strong> to be used as a password for decrypting the strings using XOR operations.<\/p>\n\n\n

\n
\"\"
PRNG algorithm used to permute the key.<\/figcaption><\/figure><\/div>\n\n\n

As a summary, a diagram explaining the string decryption routine is shown below, considering the final decrypted string “Google Chrome” as example.<\/p>\n\n\n

\n
\"\"
Diagram showing decryption process (example: Google Chrome)<\/figcaption><\/figure><\/div>\n\n\n

It is expected that in future campaigns, the decryption routine may vary, as it has in previous campaigns. By following this code, it is possible to decrypt the strings protected by Grandoreiro samples and, in doing so, obtain the IOCs, even if the sample evades the sandbox.<\/p>\n\n\n\n

Indicators of Compromise (IoC)<\/h1>\n\n\n\n

Domains<\/h2>\n\n\n\n
    \n
  • flightradar.mymediapc[.]net<\/strong><\/li>\n\n\n\n
  • simpsonsbartmovies.stufftoread[.]com<\/strong><\/li>\n\n\n\n
  • bayerischemotorenwerke[.]nflfan[.]org<\/strong><\/li>\n\n\n\n
  • mapfre.homesecuritypc[.]com<\/strong><\/li>\n\n\n\n
  • renault.hosthampster[.]com<\/strong><\/li>\n\n\n\n
  • marronfiveshows.serveexchange[.]com<\/strong><\/li>\n\n\n\n
  • airforce1.mmafan[.]biz<\/strong><\/li>\n\n\n\n
  • camsobservations.nhlfan[.]net<\/strong><\/li>\n\n\n\n
  • mercedesbenz.mysecuritycamera[.]net<\/strong><\/li>\n\n\n\n
  • michaeljacksontribute.mmafan[.]biz<\/strong><\/li>\n<\/ul>\n\n\n\n

    Grandoreiro samples<\/h2>\n\n\n\n
      \n
    • 5bf5697cb0c303d69bf6ac97f6ad5dbad310f28fdf40c7fb9099cc91583935f2<\/strong><\/li>\n\n\n\n
    • 50e3ec3a618b59f503c6a8cdb07c89e8d648101311409a32382652f7f928f514<\/strong><\/li>\n\n\n\n
    • 6dd776c16c704abed1e6ae6ff3848690b5b3e28b4180875238f0c1308f023aac<\/strong><\/li>\n\n\n\n
    • 4bddf4a85a59b41ae693bec7995281f56ba4daf927191bc09a3a4579ffe96630<\/strong><\/li>\n\n\n\n
    • 8fe15db736b045d5c52bfd378c8ca0429d0a13bacc733c0fce01d51abe8266a6<\/strong><\/li>\n\n\n\n
    • fb5f8192d6f2ca52d91423164db8f405e5c4a4e0cc74bada9292211eec127eac<\/strong><\/li>\n\n\n\n
    • 73b913c046150aeaaf1f3308b7e37fba4fa3b5d792c5dbb8c5890e908b290bd0<\/strong><\/li>\n\n\n\n
    • 05e6706fe3d060dfc1fd480cefd5726caea3e33f4730f339646684af9c279d61<\/strong><\/li>\n\n\n\n
    • 8114064407911492cd9311737500c1019b62d4e81a71d2e1a20ac5114a63f14e<\/strong><\/li>\n\n\n\n
    • 726171f87b348a13975ac9ff8a1eb05a3a13d602da09d7ea8c68f277d97bf67d<\/strong><\/li>\n\n\n\n
    • 01194208095f4d6945a080583cfab1751124c624a57512c32cfdf7fdb696ff39<\/strong><\/li>\n\n\n\n
    • 39fc2a96282e1ab00348a986932e00f06da7413a944ec5f89f96d67c0c207f07<\/strong><\/li>\n\n\n\n
    • 0ce57b80d84893e790f9f10fa717fb324e0950f3ce25fd36b944c547a6f3f1c1<\/strong><\/li>\n\n\n\n
    • e4a8ee5db0fb4af10ba873f85bc75122956c50fa41b9fc68d07052e16048cce0<\/strong><\/li>\n\n\n\n
    • 574567ab261128f235d52148c907d116cb2f5b19d140d6a50900c786ddb8ac42<\/strong><\/li>\n\n\n\n
    • 8a651d9942c7a2ffd18061cbd2beb0270fa75fce4d843732f3a7e04aa7f066ed<\/strong><\/li>\n\n\n\n
    • 0c76553235c38d616f08cea0e23023bdd8c3b50e553e30273c7de2ec09d48a32<\/strong><\/li>\n\n\n\n
    • d9df41225ae908270b11f51d92d740cbfc70209179f945ade83cee7d4c523ea8<\/strong><\/li>\n\n\n\n
    • 0b85af6d9a84e4253923f7f79b7ffec7d3050a91830a3f826f1b7bda13fb7327<\/strong><\/li>\n\n\n\n
    • c2153ab1a1321abb704fd815a2682f83bf6d5b16eb4de126c6c85c5373cb11ac<\/strong><\/li>\n\n\n\n
    • 4a3e98ddce8702d0c680ac316d8edac8cf94a613720d918ef252651051ccccfa<\/strong><\/li>\n\n\n\n
    • 27bfb19e2205709f37b94b5341ec6ea9050092d84c6663ee8cc87b1bb62376a6<\/strong><\/li>\n\n\n\n
    • 623ea30efd9c21026f1a4d3c4eee67bf489effc5bf7f50b331a06e1f164da6e9<\/strong><\/li>\n\n\n\n
    • b6ccdb7fd20102480ca77a925b46f880ddd7c53a5094b7e48e9bd27afad51fbe<\/strong><\/li>\n\n\n\n
    • 0d7e68f13cbfb94e51c8f17d911723d6aa5694b92153e6b3a2c2423c5fa9a1bb<\/strong><\/li>\n\n\n\n
    • e8a1e561faaa41fab3b4490b92327998541b9e225a616132c4eaf5f1902d48a9<\/strong><\/li>\n\n\n\n
    • dc86ef1d816d9e59e47f7c4c663eccc9959a58001128f833230c550c043e8b51<\/strong><\/li>\n\n\n\n
    • 68e389cb7c7c9e53bd32769c480b8e44e7c05381a9899e0bca06ccf1787b3a93<\/strong><\/li>\n\n\n\n
    • 4a6aa3a0e586ea8d2a4e55be90c96cf08b041b6d0fa5b57c66559e3073ef5d0f<\/strong><\/li>\n\n\n\n
    • 3a7e43ab7bd9d7c431540d21c837c8672d57778281d2b3149e58500f63166410<\/strong><\/li>\n\n\n\n
    • ca0e531114a9f606966e37cc0f3332f891bd7f360b79e3ece8fe392fa7d0a13f<\/strong><\/li>\n\n\n\n
    • f94b5c9b381e556bcab6f865232d738d39e4733fcd21d3794d1c0ed79ef83b94<\/strong><\/li>\n\n\n\n
    • 272821f02f9e6f8705339ec65f7b53983879d636bcb6b4bf825a974b8289b102<\/strong><\/li>\n\n\n\n
    • 42d079446c0a24b4334cb9c8b72623a75ed7aded959ac38ecd97d098067e4a04<\/strong><\/li>\n\n\n\n
    • 80140052a769ad5f092676c92db6eddef8760d27c90d86127ea8aee0eb00fc43<\/strong><\/li>\n\n\n\n
    • d98bf95ba605f725c86e0375535dd9617e26e8636973ec4b7f8b6bb4323854e0<\/strong><\/li>\n\n\n\n
    • f8a99695a5e74844e5e8c75e87803efc76aa8d57640cf6fa712b5d03c64fea38<\/strong><\/li>\n\n\n\n
    • 5b7a8035f90b4091a212eba0ec436584a36c927f71208ac3141311a4a96de6c1<\/strong><\/li>\n\n\n\n
    • adcb591f08f0fea634d248d2e631c93c65f7ba03bb95fd614bda1e5fa95ae140<\/strong><\/li>\n\n\n\n
    • fcc19bee18c570a38276fedeaa1a10e66efa2f21751e796ef1e498b0f7fbed31<\/strong><\/li>\n\n\n\n
    • 2a96cf4e7d0bf873760e8082b426f9e1197109c70027cd688453de566fe35851<\/strong><\/li>\n\n\n\n
    • a0bfbb40f4b6e6fa275b693205c67e338657c7589af5415716500a0b2f588473<\/strong><\/li>\n\n\n\n
    • 0c6d823ed37340809a9d0160bdf9bf5e988d32ab8e7fee1faa1e23d8d4a1dc5d<\/strong><\/li>\n\n\n\n
    • 1f43bb43970e05f79c3abe6f79a428909d1a2f587605979d621345351f2f0bc0<\/strong><\/li>\n\n\n\n
    • 944629e4b9b51cc09a48fdcaeda71c8ee4095bf46439110ab8ef2578c54a12b4<\/strong><\/li>\n\n\n\n
    • 4fba83a8bba564da0bd08f9c120d43694cb5c25657b558a9de440426fffb0cc4<\/strong><\/li>\n\n\n\n
    • ca7790976ec18a6d9d9fa65d09c933944f5a11ad28afbc5518c3d2880c3f9076<\/strong><\/li>\n\n\n\n
    • f6ff943fbb0244a8a943fab6dae7e990f12b23f3eb9c2aadec7b531faf070ec9<\/strong><\/li>\n\n\n\n
    • 99ed4df9ec65131974b87dd8fd4a0a782aec3382ab42fe54498c7a992ff03846<\/strong><\/li>\n\n\n\n
    • 4a71a5f71bfc9c8afbe5a5346bcee5d798ff1200bcb33f410082768a44c96ce7<\/strong><\/li>\n\n\n\n
    • cf7791940dbacfc11474a3ec75fd761cb7d5b02b3b2b5aa4da44f3b737360e69<\/strong><\/li>\n\n\n\n
    • d440486c79a80fba7a8472298c3fda7e5866b63ed67871c4864040f3384a541e<\/strong><\/li>\n\n\n\n
    • 4d1d80a4b4aae5d93206369775689020ba7dd31426b20d190f44738c61b55099<\/strong><\/li>\n\n\n\n
    • 43e45831d956fa539806b6435b0d10db65d2a443569c02f46f69322b707320ee<\/strong><\/li>\n\n\n\n
    • e64e22b17b67b7db6e95849f9951ea8f0e9666c7154a53bd9d316aca374a839d<\/strong><\/li>\n\n\n\n
    • b1554dfaa8f402f5c96c3a0cc8f99198fe68019c55e162c96e983b3bea5e47d2<\/strong><\/li>\n\n\n\n
    • e9cfce1de32261f4bbb006f9bf56c1f9d453724bc794ecd7ee9a7b3d81d83b63<\/strong><\/li>\n\n\n\n
    • 923f4618105ecf77fca9bca4b2eac1ded8fc58cfe1d0a371dba1710617ece2f1<\/strong><\/li>\n\n\n\n
    • fe83c4c52bc751b0711e7064056f0a3350d396efd164f3e2a9b01e4984c30418<\/strong><\/li>\n\n\n\n
    • 028a9732e10b240d511eaafdd0deef526647c66abb2101a924f1311079023c5b<\/strong><\/li>\n\n\n\n
    • 77c0dc05bf0882145ed320dc2906c0dd5efa766dbaeacf7c74f05c0472dec4a1<\/strong><\/li>\n\n\n\n
    • 32ad908a32fcb319fb228b9a73f64d691716660281e40d27f432aaddf4566008<\/strong><\/li>\n\n\n\n
    • 56b4058b4535b20cc1c44b274bf57185b8c0f9cc1b42fbf09883cac209711064<\/strong><\/li>\n\n\n\n
    • 26121c26958e8018deb4b2ad3fa10ef6485787d9ad56a0de5fafda89d5efef4f<\/strong><\/li>\n\n\n\n
    • 373087927e758931052139a07294365ac4392809a2e786a3141a728bf0366b3e<\/strong><\/li>\n\n\n\n
    • ba1db0cd812e3996917a5d53fca6100d97747e691192257e551c51801be6fb07<\/strong><\/li>\n\n\n\n
    • 6aca8b5ad302f53d2adf7bf7d1d50ce9beb978605c0825829be69aa7c6e109ec<\/strong><\/li>\n\n\n\n
    • 78cc0600c65d3556d5897ec90f08bb062782aa8e0b6fef869ad8eacb90ee5fce<\/strong><\/li>\n\n\n\n
    • 04a2a43ae1005d5dcbab6e6749d33e24f52a8ca2f891667462d86d40930db47b<\/strong><\/li>\n\n\n\n
    • a120c997fff43de7c2d80bb8420fb513d5c4cc25ed551de590516eaa807f6e25<\/strong><\/li>\n\n\n\n
    • b7df1e956eb9c7f7f7f3db05717b276caba722a158ea01fbaeafac69b078bb0a<\/strong><\/li>\n\n\n\n
    • 0306683cb13e01ae61be5195579bcfbe25cf3b50a3916ef81fe3e2fe8a8f757b<\/strong><\/li>\n\n\n\n
    • bcb6e044f9c5b0dd1613afe779ef374c215556e408648c163ca9c7e61bd012e1<\/strong><\/li>\n\n\n\n
    • 6a7b619f6da998119f5ad8d2f6173baf101bb063f44cbe3487ed8f3c67f60e8d<\/strong><\/li>\n\n\n\n
    • c90c4822a1ada276a92ae92ac2c9e5e5a2241ef0e1955d472e82244b05de7b40<\/strong><\/li>\n\n\n\n
    • a48956714ad8e26b407eb684521ceb3052488fba956119583ec948483f3dce2e<\/strong><\/li>\n\n\n\n
    • e57bdfa8dcd5d8d67636dc3a0f8b64b30887d740c45dfe06952f068276305154<\/strong><\/li>\n\n\n\n
    • 22f95266c3e7ff1987ea5bba815c294b424f039261aa85b397e1326ee8d627ee<\/strong><\/li>\n\n\n\n
    • 4b3fcb0697c76e227f5461637bb804ca00630fd73182f1c55a7cef88bb0b4529<\/strong><\/li>\n\n\n\n
    • 28ac45c1c68f846378ca097904029c19bb3d0e044bc28f2d5f91984a9dd390bc<\/strong><\/li>\n\n\n\n
    • def88a0ce4de231415c91131a9e47583e0197d1367b026966230852d9bb24f47<\/strong><\/li>\n\n\n\n
    • 6781fd694160090ee43c11d0b29d94dc84b8c399e610d4947fafde5c9744cd57<\/strong><\/li>\n\n\n\n
    • 6cd92847b4ad57f42aa97dfcf055f1d0a4242ced55a197b3d21fd08366eeb155<\/strong><\/li>\n\n\n\n
    • 91f912195e3d1d226697a498f322c112b6bfc2650a4fa23f7e975e7e08200c2b<\/strong><\/li>\n\n\n\n
    • 7ac40f86d76d72a9a489a78317517cfe99e7cd47739b08b8144ff9b9c4fe0d7e<\/strong><\/li>\n\n\n\n
    • eb78679176cfb8fb34f0088e36eca23643bece992d92ee8270403199e8e24858<\/strong><\/li>\n\n\n\n
    • 59e1edeab48031cc98720d10734ad4147a13bcc8cc8a924fa15d73c8dae368fe<\/strong><\/li>\n\n\n\n
    • b050e84ec408e43bae67a4624f95b1594022e79c7a8ee745dd7d36ed2eb2a397<\/strong><\/li>\n\n\n\n
    • f810650e0735b8261f9ff7c76ac27380f561591c54932740bd5755383f56d57e<\/strong><\/li>\n\n\n\n
    • 7cf7c9f8c05aeee52273c6571cc55d375c44ffe3597d0ce9770f76db12d873d9<\/strong><\/li>\n\n\n\n
    • 401960841f1fe7ce21b6fdadac696d5c350e963560f5038ff02958b364e1b6d6<\/strong><\/li>\n\n\n\n
    • 4856d592f80e83e841e057b95dc30b2fc901716228644eae5280fd5595c1faca<\/strong><\/li>\n\n\n\n
    • 9691f4b9c935f0452d409cf755f3ddad343d8695316f8da9595b64dd32181a04<\/strong><\/li>\n\n\n\n
    • 11bf5f21e6ada8d11d4abe1c734597307c871a551f6812015da70abc7b00af37<\/strong><\/li>\n\n\n\n
    • 55e785fc38e102d615d9eb764b1842df851cb3e873bc1231c9eac78f16a6860a<\/strong><\/li>\n\n\n\n
    • a90017c28771eac8890483005c955b1d29cf0199c24d1d4992c8b843ff2496dc<\/strong><\/li>\n\n\n\n
    • 6b117f8bc5a27e4f7cf48d0302c715a8f08e77fe87626fe1121bc97a699c125a<\/strong><\/li>\n\n\n\n
    • 604c958c40a3e1630fa8a596b97e5294286ffa967dbe6136eb28bd7b98c203fa<\/strong><\/li>\n\n\n\n
    • e265d06735e97ed021731f4d4163e13ce11bf572b44a1a4318cd22671d7efc9c<\/strong><\/li>\n\n\n\n
    • c2426555fff31e2b13ca3e33d2c43f1ba63dc73bb1f35a350a7cdfc983c2dff3<\/strong><\/li>\n\n\n\n
    • 9e1cf99f286827c3f03d4f15e81465080133589e0b75128ac19a7f961fef268e<\/strong><\/li>\n\n\n\n
    • a4cf0d16e83b5b9cdca99d0423488a46e5181b5377b8dc39d8d94d80e2c77e60<\/strong><\/li>\n\n\n\n
    • 5ac1f0a97bc072b98df34a2a5be7fa2bec284f07c037825772cc807d7bd30476<\/strong><\/li>\n\n\n\n
    • 489cbf0ed2df2871d265b72e049240dbb6af527f46fd8a75056cbaf5dd2426ff<\/strong><\/li>\n\n\n\n
    • ee03224052cb97c88756ac1ec7f1e63d62129b35189023ee21c76b0a0d92430b<\/strong><\/li>\n\n\n\n
    • edad942ce90dc32a2f87a8b365e8a3ba409d663331df20fca37cf0ff1e51d42e<\/strong><\/li>\n\n\n\n
    • b4152dd07bb8ce7786c3af03b24f55eda307e2bb1901d688678fc2fd91fbf680<\/strong><\/li>\n\n\n\n
    • 28f130cc253d8b1cd95479143e9b0819eb1f2744097a996c41b82a1851206068<\/strong><\/li>\n\n\n\n
    • faf61c2e91e923422fb6b9330019044261d51e6d05e4a775496c8f23cf511bab<\/strong><\/li>\n\n\n\n
    • 9330f7fa5d7cc25c0b61ab0385fed96f0fdb93418ed6befb488fe616c4b1a2f7<\/strong><\/li>\n\n\n\n
    • 5338f216297da245971b68948a3002519e0d38f6e9138dc4be9a50deb377ef58<\/strong><\/li>\n\n\n\n
    • c6708cad7ee1bf37f657dc57b331fe56b551205f9465f1002bcbf36a649a78bc<\/strong><\/li>\n\n\n\n
    • 6ff42b85d2b9745c6d4edcfc129a522690627aa7a66c4540a899538e5cf3b34e<\/strong><\/li>\n\n\n\n
    • dc847be4793c40e215346f40b7a9f9788f1d2a506050cecb05789db5dbb622dc<\/strong><\/li>\n\n\n\n
    • 35fab0249511025af18f2bf33a29bf2be23507c9c5000f9b5fa26cd57ac5bffb<\/strong><\/li>\n\n\n\n
    • 7b671eb157d4126f8818ea2cba39ecf7922acddbfe213a190b393023befdeffd<\/strong><\/li>\n\n\n\n
    • ca219abfd00bca589699613004fea91105be3b59c941fce7029c38ed6055e407<\/strong><\/li>\n\n\n\n
    • 526a9ceaff2ee12ea7cd6c1ec0c9ef31a9f5c7ec6a65fab66114826d43920f77<\/strong><\/li>\n\n\n\n
    • 198e817151db9b44f5f879135aa1d42285e8b04e573308f05fc47c5915a9186b<\/strong><\/li>\n\n\n\n
    • edd42a8b9de916efdaafd4556020dd5ef77800bed2951f847e9ff89fb8255191<\/strong><\/li>\n\n\n\n
    • 99e41a43c22b65a019c22e624f34e46588ba513e4bff3a7bb23464d866a9830c<\/strong><\/li>\n\n\n\n
    • e738bca5cc1d0c635af58adbb1ceb319275247672f4fe8a9a3384e3944f8c9eb<\/strong><\/li>\n\n\n\n
    • 1c45b6066c93e1ae03292655d558e1ca828f4c43e1af2c1a9be6663d8c21f7f5<\/strong><\/li>\n\n\n\n
    • b2462d3bcc0b2019f547cf3dab119e9e2a3fb362e83ec52bc4530fa7388fa26e<\/strong><\/li>\n\n\n\n
    • 31f1ea68dcebd08db98383579d33a46fcf55026fbb73a0bc8a69ed28e48d9cfe<\/strong><\/li>\n\n\n\n
    • 643db9eee1f71cce4dd4e27ae5687c93c85e91baa18e47127074f609add1f0a1<\/strong><\/li>\n\n\n\n
    • 8a4c7895114c65d9174ae744aeff93024214d9bbc76cafd3e9f21ffbce8efdf4<\/strong><\/li>\n\n\n\n
    • 7913c40a5a616b15a4e89375bd084508d066ca47fd7553fa1a0a99128e09e5a4<\/strong><\/li>\n\n\n\n
    • a3e15bdd4b8406972a31aed4106a8801c6fdec4521a301e5a282cd9f90762c51<\/strong><\/li>\n\n\n\n
    • 386da5129932cff17210ff8e635c6d03d371e01a94c6e494fa1c237066f86289<\/strong><\/li>\n\n\n\n
    • ae471e8035d65784507dcb6ff5a1904a571664a33334962927aa6d6a190d7f57<\/strong><\/li>\n\n\n\n
    • 5a048decf04b6961fda70dd97fb35bbc87a737c83167159efb67f51af67988ea<\/strong><\/li>\n\n\n\n
    • 3fdf982d21e8ccd6ba6e955543d3d2f9d370044ac7d6a9acc50b9d3223ef899b<\/strong><\/li>\n\n\n\n
    • 787f69def34bc27b75faf847a5f46b29dd5ef8fdee4038308a7561b08186b6e3<\/strong><\/li>\n\n\n\n
    • ca9a589968ebbbdf3b5e22fafdf2b710bf0f301f88c39eb1865b900386fcd4a2<\/strong><\/li>\n\n\n\n
    • 20e3c6baf50adb0ae00d83a146d0e28b6d0a282f311f7240873e00fc89e65b97<\/strong><\/li>\n\n\n\n
    • 245cfab9d4f55115663456493d11ca4449c00e1866f2efcad9b3b056ac30fd96<\/strong><\/li>\n\n\n\n
    • b76724f885aa00040050806d37f1603439868f9d8fb7329a38db0948b1075641<\/strong><\/li>\n\n\n\n
    • b8d742e12ab2dce7306caea26ac647b00aa66c5714c4c84524d0d7e35c9c63c6<\/strong><\/li>\n\n\n\n
    • 96c5f31b62af94896fd7aa7dfee7e2a13c7d75bf046b3e9a174feed99bef94cb<\/strong><\/li>\n\n\n\n
    • 77df78fdbea093bbc8c347db772f13001b6ff443a5b423764040278249bb313d<\/strong><\/li>\n\n\n\n
    • ee507459cfacf5c0fdb84bebbe410eb9a7ed52a8089e59ea986bfc529e5ad1c1<\/strong><\/li>\n\n\n\n
    • 3767b4501f767e5b7ae41602c28254bc3a57d6db26d94e588932248d8b61cd5d<\/strong><\/li>\n\n\n\n
    • 68f92ec77258d0a3d4570d4b70a2743cbe99f64329488c518e05414c54ab2c3a<\/strong><\/li>\n\n\n\n
    • 67ff327124e9197224f027f381640d10b89a23605276f9840c388622982b9492<\/strong><\/li>\n\n\n\n
    • a3caa47ab11f0bf78341d600f3881c4a8c81afe3e6996712f434b7ee73d61f0f<\/strong><\/li>\n\n\n\n
    • d23577500aa01105387eee9d1354a5a2830932c7fb801c72aa6df37d78ee1c8a<\/strong><\/li>\n\n\n\n
    • 77bc4990e07dfbe45e8ba400b8825f9bfe876e31abfb037168c7dca9cc84f9ce<\/strong><\/li>\n\n\n\n
    • 7b869ee1fb74b9953af0b843094f9dbc35e0a05c02341e5ceede1c4647543c95<\/strong><\/li>\n\n\n\n
    • 193feb2a4e26c12f4bb4f00faf92eff926fd4fd4aa27a7e3dfac1858f1b1ff6d<\/strong><\/li>\n\n\n\n
    • a4e8aa05093429861824831ce3e708db9cbf3721d791b9b08b45a3b807342811<\/strong><\/li>\n\n\n\n
    • 79840c1ca146c7bb0263a9ca78e78dd502c3ef8071af3f35366b6c6707b2f4d2<\/strong><\/li>\n\n\n\n
    • 70f44232131fe4bfa584a4fe801e060bd5cec7c8c7c62f77ae077561e75c057d<\/strong><\/li>\n\n\n\n
    • ca040852f6b973f8846f6cca00a60abb264a46c459d5290be3e2206f6d80690a<\/strong><\/li>\n\n\n\n
    • 9ae358cc488b1bc478652ec84e498f118f8f9a1f3140be268c94658740f42c90<\/strong><\/li>\n\n\n\n
    • 172d42802482d507e8f6683f6ffb825071d66f3c1258e92943db27b0f801ecf0<\/strong><\/li>\n\n\n\n
    • afa5fd76d35dd641148a38eb8ccd5260696566c27cf42f980bf933012fd53f0b<\/strong><\/li>\n\n\n\n
    • 89e907f3a48b3e837547e01d0528ef106aa38bb4ce287e2cf927dc98a39f5501<\/strong><\/li>\n\n\n\n
    • 35379d795201b58b50db071953f6b33b80d34493673435e132efc8eb272bc0e1<\/strong><\/li>\n\n\n\n
    • 6664cb0180449f0232342e271afd7db8464c00ca268cf6a1b269bdcfec5cb56a<\/strong><\/li>\n\n\n\n
    • da320410b5407d29f8a150e5e598b1181fa3a4238e20e9eec4f5048ce050e43d<\/strong><\/li>\n\n\n\n
    • 043a76713890dedadd97ee677801b0d0e3a16535107eb59fce34d85df5176106<\/strong><\/li>\n\n\n\n
    • c1d240eaa0fcf0b8c4c4432309227ecc980da7e2db0eaba1659e222591922f50<\/strong><\/li>\n\n\n\n
    • 0fc38ff1367aca70a85d99a9580ec25e3c6b170418ef57282c4ffd2b086984cc<\/strong><\/li>\n\n\n\n
    • d6e823fa5d81b3878f04bcbaf4fad22279bc8e8c872a3f77323caf265a282c43<\/strong><\/li>\n\n\n\n
    • 97535f4957224ab823fa9ea33852f7913e4de4455f1a02547dbdabafc1d30117<\/strong><\/li>\n\n\n\n
    • c140bab429fca3468a9c4626e37b2e65bb9ddf7438e8892becf620bf0d405040<\/strong><\/li>\n\n\n\n
    • b7fcbfec6614c09882654c1b5be9463137ba0aa21dae1eacbaa306646c7d465d<\/strong><\/li>\n\n\n\n
    • f9b235dc0d3d63304f455d303c01c81d47aed3235978dc467235f1b94c59e34a<\/strong><\/li>\n\n\n\n
    • 9c99747edf4d3e14fd6d9634d70429cbf2f02c6134db4a2ccfce33e604b04bb4<\/strong><\/li>\n\n\n\n
    • 0da07060be36789488086e9c09fcf2dc0df6da4ffa1171b3da9cb8d366cf6ac3<\/strong><\/li>\n\n\n\n
    • bd6984b746a0a88fd4bc985b5c7ff08584d96ff67c193bbe8e1cacefa3205a2c<\/strong><\/li>\n\n\n\n
    • af42a4172bb41d6b504b433e19ed4ef4d30b639ed7d2cec592982a51678b8e1c<\/strong><\/li>\n\n\n\n
    • 03c813f6416ddbda74aa1eb10b3314bcf614be8ca62405b680fbb84bbedbc640<\/strong><\/li>\n\n\n\n
    • 3b9326585b7019a1fa87c8a14fbb104c97b2ecf0b46a882c8cf8538a98fb6488<\/strong><\/li>\n\n\n\n
    • 42ef95f21dc4ea3c610593f8cd9fc6364aa849acf3fef3b70d54f2bbeb7a382c<\/strong><\/li>\n\n\n\n
    • e1b8314e9a34326d2fe4b0764def77076cac41e3affa58784d0a96b3497a4499<\/strong><\/li>\n\n\n\n
    • f4c7fb8ac578446e41722c236c3a123dcac599a440c69e46595e01fc4f204f47<\/strong><\/li>\n\n\n\n
    • ab0c75dd6d7159b18cfe38e751883c0c6d0f34b1c5962849ec6076bc84e31456<\/strong><\/li>\n\n\n\n
    • 3b0b691496855553218ef6135c79043b693c2914d53e25ae7ec9d6d239d994bd<\/strong><\/li>\n\n\n\n
    • d80760d920950c10c90b2f8cab9f206e7225a71e1618bdd2a6d3e357c22fbc5e<\/strong><\/li>\n\n\n\n
    • 1b67637f9b9a7e8195bedb9bceacd76303e4b897cfc7e42995bfc9c940505ae5<\/strong><\/li>\n\n\n\n
    • e4f6626a4bd1f26486fa3c94691b5ce73d477517059363dc231b6f90a8be2874<\/strong><\/li>\n\n\n\n
    • 10a06f9117dff59032483023bc46dfaf96cae24fd9937ba88b80817349bfe631<\/strong><\/li>\n\n\n\n
    • 05bc91c076049c1cedbd9f742cb168b0b951521ebac660822786fab6830e92b3<\/strong><\/li>\n\n\n\n
    • c688682c5f0e3c920f03cf84fab6d407b345000ee17380f8a8669d2f08ae11e4<\/strong><\/li>\n\n\n\n
    • 4f4dca0efaedeedb9ae9289770bd0e865b2cd3fb91eadce041590a2f3c09524e<\/strong><\/li>\n\n\n\n
    • df9a099b6e5fe8b847a41d1c36a271aad63bd15b120cef38fefb6e068a0e5f55<\/strong><\/li>\n\n\n\n
    • 94d28300ce41bf60b9f231e5fb5b82d76f084012bc5917c77e332908f514969c<\/strong><\/li>\n\n\n\n
    • f8dbaf0fbcaa27d782b25802573d0d029ef76ca4cbac97e2a0d4c0c586c5071b<\/strong><\/li>\n\n\n\n
    • d4757c94cb65748af7f566b3e1cdf0109d205ef5455ef8c612b77960a103b92b<\/strong><\/li>\n\n\n\n
    • e17cfa4939ac30f741ea6fbdf982bd6a759836e12329d2375685b9fd22579d84<\/strong><\/li>\n\n\n\n
    • 07f275a27e36c4d347257449de79dab241ecee7e45186d57d0081c42f22d4230<\/strong><\/li>\n\n\n\n
    • b0f6e2f453453bf7b87e950fd1d63c7b7901dd004cf75c6762780b2052f182d8<\/strong><\/li>\n\n\n\n
    • 7f2fd97dbf9e98f2b4eeed330630fdd4a3e26f06909f01987de58515f43cdeae<\/strong><\/li>\n\n\n\n
    • 2a470979ac47339885b08cee096fb4896ea1b1bfccc80d19e19c9a61e546fc6d<\/strong><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"

      A new campaign targeting Spain and Latin American countries, utilizing the Brazilian stealer Grandoreiro, was detected during March 2025. This report provides detailed insights into the malware’s behavior, along with an explanation of the string obfuscation and decryption techniques employed in this campaign. Grandoreiro Grandoreiro is a Brazilian-origin stealer malware that has been active since […]<\/p>\n","protected":false},"author":28,"featured_media":2827,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[18],"tags":[82,44,52],"class_list":{"0":"post-2805","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-cyberattack","8":"tag-grandoreiro","9":"tag-phishing","10":"tag-stealer","11":"entry"},"featured_image_src":"https:\/\/lab52.io\/blog\/wp-content\/uploads\/2025\/04\/Imagen2-600x400.jpg","featured_image_src_square":"https:\/\/lab52.io\/blog\/wp-content\/uploads\/2025\/04\/Imagen2-600x600.jpg","author_info":{"display_name":"3722304989","author_link":"https:\/\/lab52.io\/blog\/author\/3722304989\/"},"_links":{"self":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts\/2805"}],"collection":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/users\/28"}],"replies":[{"embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/comments?post=2805"}],"version-history":[{"count":13,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts\/2805\/revisions"}],"predecessor-version":[{"id":2836,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts\/2805\/revisions\/2836"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/media\/2827"}],"wp:attachment":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/media?parent=2805"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/categories?post=2805"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/tags?post=2805"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}