H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Grandoreiro](https://attack.mitre.org/software/S0531) is a banking trojan written in Delphi that was first observed in 2016 and uses a Malware-as-a-Service (MaaS) business model. [Grandoreiro](https://attack.mitre.org/software/S0531) has confirmed victims in Brazil, Mexico, Portugal, and Spain.(Citation: Securelist Brazilian Banking Malware July 2020)(Citation: ESET Grandoreiro April 2020)

Labels

malware

43 recorded

Relationships

uses

to Application Window Discovery

Technique

uses

to Asymmetric Cryptography

Technique

uses

to Bidirectional Communication

Technique

uses

to Binary Padding

Technique

uses

to Browser Extensions

Technique

uses

to Browser Session Hijacking

Technique

uses

to Bypass User Account Control

Technique

uses

to Clipboard Data

Technique

uses

to Credentials from Web Browsers

Technique

uses

to Dead Drop Resolver

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Disable or Modify System Firewall

Technique

uses

to Disable or Modify Tools

Technique

uses

to Domain Generation Algorithms

Technique

uses

to Drive-by Compromise

Technique

uses

to Email Account

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to File Deletion

Technique

uses

to Fileless Storage

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Malicious File

Technique

uses

to Malicious Link

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Modify Registry

Technique

uses

Technique

uses

Technique

uses

to Network Device Firewall

Technique

uses

to Process Discovery

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Security Software Discovery

Technique

uses

to Shortcut Modification

Technique

uses

to Spearphishing Link

Technique

uses

to Steal Web Session Cookie

Technique

uses

to System Checks

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to System Time Discovery

Technique

uses

to Visual Basic

Technique

uses

to Web Protocols

Technique

uses

to Windows Permissions

Technique

3 external

References

mitre-attack

S0531

ESET Grandoreiro April 2020

https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/

Securelist Brazilian Banking Malware July 2020

https://securelist.com/the-tetrade-brazilian-banking-malware/97779/