Grandoreiro goes north: From Brazil to Mexico with a new DLL sideloading campaign

Grandoreiro is a notorious banking trojan that has been operating across Latin America since at least 2016, targeting financial institutions and their customers through phishing campaigns and social engineering techniques. Written in Delphi and Brazilian in origin, it is one of the many of Latin American banking trojans (alongside Guildma, Javali and Melcoz). Over the years, the malware has gone through multiple iterations and infrastructure changes to evade detection and sustain its operations. In January 2024, a coordinated operation led by Brazil's Polícia Federal and coordinated through INTERPOL — with Spanish authorities and private-sector partners — disrupted significant portions of its infrastructure and reduced its overall reach.

Despite these actions, Grandoreiro has not been fully eradicated. Activity associated with the malware can still be observed, although at a considerably lower volume compared to its peak operations. In May 2026, we observed a renewed campaign in which Grandoreiro operators abused the legitimate application Duplicate Files Finder in combination with DLL sideloading techniques, continuing their established pattern of leveraging trusted software to stealthily execute malicious payloads.

In the following sections, we analyze Grandoreiro's initial downloader, a lightweight component in terms of functionality; however, it is heavily protected and incorporates multiple defensive mechanisms. These techniques are designed to detect sandboxed or virtualized environments and hinder analysis efforts, significantly increasing the complexity of reverse engineering.

The analyzed archive was delivered as a ZIP file named Fac-BH22DC0608_RevMQKSAC.zip (MD5: 82f771c3ec4fe979c3ae00372e8c3ac8). While the initial delivery vector could not be conclusively confirmed, both historical Grandoreiro distribution patterns and the invoice-like filename (with "Fac" likely referring to factura, meaning "invoice") have led us to assess with moderate confidence that the malware was delivered via a spam campaign.

Inside the archive is a hidden folder containing decoy PDF and XML files designed to evade heuristic detection.

DLL sideloading is a technique where an attacker places a malicious DLL beside a legitimate executable that automatically loads it through the normal Windows DLL order. When the trusted application starts, the malicious DLL is loaded into the process, allowing attacker code to execute while appearing as part of a legitimate and often signed application.

In this campaign, the authors use the legitimate Duplicate Files Finder application but rename it to a randomly generated filename to obscure its purpose. When executed, it first loads another legitimate dependency, dupfdll.dll. This DLL then attempts to load its dependency, mingwm10.dll, which is not legitimate. In this case, it is a malicious replacement version.

Filename / MD5 / Compilation time:

Analysis of the PE timestamps reveals inconsistencies that are indicative of potential DLL sideloading activity. In particular, the legitimate parent application shows a compilation timestamp dating back to 2008, whereas the injected trojan implant carries a significantly more recent timestamp, appearing to originate from 2026. PE compilation timestamps are trivially forgeable and are frequently faked by malware authors, so the 2026 value should not be treated as authoritative on its own; nonetheless, combined with the sideload chain and the dependency mismatch, we assess with high confidence that a benign binary is being abused as a loader for the malicious payload.

Because Duplicate Files Finder is a GUI-based application that normally displays a user interface window, the malicious implant begins its execution by hiding the application window to avoid drawing user attention.

After suppressing the GUI, it proceeds to execute a series of internal routines designed to determine whether the environment is sandboxed or being actively analyzed. These checks are intended to ensure execution only in genuine user environments while evading automated analysis systems.

The malware checks the system uptime of the current machine. Its threshold is set to 180,000 milliseconds, meaning the system must have been running for at least three minutes. This check can help bypass sandboxes that begin analysis in a fresh boot state.

If the infected system passes the tick count verification check, the malware proceeds to inspect the software installed on the host. Rather than querying the operating system directly, it determines whether an application is present by checking for the existence of its corresponding desktop shortcut. The malware specifically checks for the following applications:

Interestingly, the presence of all of these applications is treated as an indicator of an analysis environment rather than a legitimate user system. If shortcuts for all seven applications are present on the desktop, the malware classifies the system as a sandbox environment and terminates execution. Based on this behavior, we’ve assessed with moderate confidence that the operators are attempting to identify and blacklist a specific sandbox configuration that ships with this particular combination of software.

Following the installed software validation, the malware performs a series of additional system checks to further profile the infected host and determine whether it is running in a legitimate user environment. Specifically, it gathers information :

These checks are commonly used as anti-analysis measures, as sandbox and virtualized environments often exhibit characteristics that differ from those of real user systems, such as limited hardware resources, unusual display settings or a lack of evidence of normal user activity.

In addition to the previously described checks, the malware actively searches for artifacts associated with virtualized environments. It does so by looking for the presence of VMware and VirtualBox drivers and components, including:

The malware also queries the HARDWARE\DESCRIPTION\System\BIOS registry path and examines the values of SystemManufacturer, SystemProductName, and BIOSVendor. These values are compared against a blacklist of virtualization-related keywords, including: VBOX, VMWARE, VIRTUAL, QEMU, XEN and INNOTEK.

Speaking of registry checks, the malware also queries the registry key \SOFTWARE\VMware, Inc.\VMware Tools, which indicates the presence of VMware Tools installed in a guest environment.

The layer of Grandoreiro's anti-analysis mechanisms involves inspecting the list of currently running processes. The malware specifically checks for the presence of tools commonly used in debugging, reverse engineering, and network traffic analysis (49 process names in total — debuggers, disassemblers, network sniffers, and EDR / monitoring tools). It targets the following process names:

, the malware contacts ip-api.com to determine the victim's public IP address and geolocation. It then blacklists several countries, including CZ, RU and NL.

We have seen country blacklisting before, often for "patriotic" reasons in pay-per-install campaigns — for example, Russian-speaking malware avoiding infections in Russia or nearby regions. However, in this case, the selection appears less ideological and more operational. We assess with low-to-moderate confidence that traffic from these countries disproportionately includes security researchers, antivirus companies or automated sandbox environments.

After the geolocation check, the malware then validates both the current username and the machine's computer name. In some cases, the values appear to be designed as matching pairs, for example, a username like "Peter" paired with a hostname such as "PETER-PC". On the other hand, certain entries appear to trigger independently, for instance, a hostname such as "difusor" is sufficient to flag the system regardless of the logged-in user. The list below summarizes the blacklisted usernames and computer names:

The malware also verifies the existence of specific directories. In particular, it searches for the presence of the following paths:

If the infected computer is flagged as a sandbox, the loader shows an error message in Spanish that says "There was an error viewing your document, restart your computer and try again."

Otherwise, if the system passes all validation checks, the malware proceeds to resolve the IP address of its hardcoded C2 server. For this purpose, it leverages Google's DNS-over-HTTPS service by sending a request to hxxps://dns[.]google/resolve?name= followed by the hardcoded domain. In this sample, the domain used is b744156103040828396040[.]nhlfan[.]net.

Unfortunately, the server was offline at the time of our analysis, preventing direct interaction with the C2 infrastructure. Nevertheless, static analysis revealed that the malware issues an HTTP GET request over TCP port 6432 to retrieve the second-stage payload. The request itself is encrypted and contains host-specific information, including identifiers associated with the infected user and system. Decoded, the request takes the following form (this is the decrypted representation, not the on-the-wire ciphertext):

CLIENT_SOLICITA_DDS_MDL|SOLICITADO*~+HU*~+Budapest*~+Budapest*~+DESKTOP-41NVP89*~+Steven*~+10*~+Windows Defender*~+0*~+0*~+0*~+1*~+42F69286*~+18-05-2026*~+00:55:57*~+*~+

The request begins with the command CLIENT_SOLICITA_DDS_MDL, which likely indicates a request for the second-stage payload. During static analysis, additional strings associated with C2 communication were identified. These are easily distinguishable as they are consistently written in uppercase:

It is notable that, although the malware appears to have been developed by Portuguese-speaking authors, no telemetry observed targets in Brazil or Portugal. This is consistent with public reporting that the post-takedown Grandoreiro codebase forked, with a "light" variant now focused on Mexican targets — which aligns with the Mexico-heavy telemetry described below.

A significant challenge during the analysis of the loader is the presence of encrypted strings. Grandoreiro implements a custom string obfuscation scheme that combines a proprietary decryption routine with Base64 encoding to encode runtime strings and complicate static analysis.

No publicly available ready-to-use scripts were identified for decoding strings in this specific variant. As a result, we implemented a custom Python-based decoder to reproduce the deobfuscation routine.

Several implementation details of the decryption algorithm are worth highlighting:

We have checked telemetry for the last 30 days in our database and observed a steady stream of activity associated with this family, indicating that despite its reduced scale, the campaign remains active and continues to evolve.

This distribution highlights a clear concentration of activity in Mexico, which accounts for the largest of observed samples. Spain and several Latin American countries follow, forming a secondary cluster of detections. Overall, the data suggests that Grandoreiro activity remains primarily focused on Latin American regions, with limited but notable presence in Europe (mostly Spain) and North America.

The observed behavior maps to the following ATT&CK techniques:

Defenders can hunt for the following high-signal behaviors observed in this campaign:

Overall, this campaign highlights the continued evolution of Grandoreiro and its operators' focus on stealth and evasion. By abusing the legitimate Duplicate Files Finder application for DLL sideloading, the attackers effectively blend malicious execution into trusted software behavior, complicating detection efforts. The multi-stage architecture — starting from a heavily protected loader and progressing to a fully featured payload — demonstrates a deliberate effort to separate initial access from long-term operational capabilities. While overall activity associated with Grandoreiro has decreased compared to its peak, the campaign shows that it remains active and continues to adapt its tooling and infrastructure.

This threat is detected and blocked by Acronis EDR / XDR.

C2 domains (defanged):