H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Metamorfo](https://attack.mitre.org/software/S0455) is a Latin-American banking trojan operated by a Brazilian cybercrime group that has been active since at least April 2018. The group focuses on targeting banks and cryptocurrency services in Brazil and Mexico.(Citation: Medium Metamorfo Apr 2020)(Citation: ESET Casbaneiro Oct 2019)

Labels

malware

46 recorded

Relationships

uses

to Application Window Discovery

Technique

uses

to Asymmetric Cryptography

Technique

uses

to Automated Collection

Technique

uses

to Clipboard Data

Technique

uses

to Code Signing

Technique

uses

to Dead Drop Resolver

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Disable or Modify Tools

Technique

uses

to DLL

Technique

uses

to Dynamic-link Library Injection

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to GUI Input Capture

Technique

uses

to Hidden Window

Technique

uses

to Indicator Removal

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

Technique

uses

to Malicious File

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Modify Registry

Technique

uses

Technique

uses

Technique

uses

Technique

uses

to Non-Application Layer Protocol

Technique

uses

to Non-Standard Port

Technique

uses

to One-Way Communication

Technique

uses

to Process Discovery

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Screen Capture

Technique

uses

to Security Software Discovery

Technique

uses

to Shared Modules

Technique

uses

to Software Discovery

Technique

uses

to Software Packing

Technique

uses

to Spearphishing Attachment

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Information Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to System Time Discovery

Technique

uses

to Transmitted Data Manipulation

Technique

uses

to Virtualization/Sandbox Evasion

Technique

uses

to Visual Basic

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

5 external

References

mitre-attack

S0455

Casbaneiro

—

Metamorfo

—

Medium Metamorfo Apr 2020

https://medium.com/@chenerlich/the-avast-abuser-metamorfo-banking-malware-hides-by-abusing-avast-executable-ac9b8b392767

ESET Casbaneiro Oct 2019

https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/