SCILabs Malteiro 2021

Mispadu uses a custom algorithm to obfuscate its internal strings and uses hardcoded keys.

Mispadu also uses encoded configuration files and has encoded payloads using Base64.

Mispadu can sends the collected financial data to the C2 server.

Mispadu's binary is injected into memory via `WriteProcessMemory`.

Malteiro has injected Mispadu’s DLL into a process.

Mispadu can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.

Malteiro has utilized a dropper containing malicious VBS scripts.

Mispadu’s dropper uses VBS files to install payloads and perform execution.

Malteiro collects the machine information, system architecture, the OS version, computer name, and Windows product name.

Mispadu has used a variety of Windows API calls, including ShellExecute and WriteProcessMemory.

Mispadu has the ability to capture screenshots on compromised hosts.

Malteiro has the ability to deobfuscate downloaded files prior to execution.

Mispadu decrypts its encrypted configuration files prior to execution.

Malteiro has relied on users to execute .zip file attachments containing malicious URLs.

Mispadu has relied on users to execute malicious files in order to gain execution on victim machines.

Mispadu can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.

Mispadu has been installed via MSI installer.

Mispadu can run checks to verify if it is running within a virtualized environments including Hyper-V, VirtualBox or VMWare and will terminate execution if the computer name is “JOHN-PC.”

Malteiro collects the installed antivirus on the victim machine.

Mispadu has obtained credentials from mail clients via NirSoft MailPassView.

Malteiro has obtained credentials from mail clients via NirSoft MailPassView.

Mispadu can steal credentials from Google Chrome.

Malteiro has stolen credentials stored in the victim’s browsers via software tool NirSoft WebBrowserPassView.

Malteiro has sent spearphishing emails containing malicious .zip files.

Mispadu has been spread via malicious links embedded in emails.

Mispadu checks and will terminate execution if the compromised system’s language ID is not Spanish or Portuguese.

Malteiro will terminate Mispadu's infection process if the language of the victim machine is not Spanish or Portuguese.

Malteiro targets organizations in a wide variety of sectors via the use of Mispadu banking trojan with the goal of financial theft.