Grandoreiro Banking Trojan Resurfaces in Mexico with DLL Sideloading Tactics

The Grandoreiro banking trojan has re-emerged in a new campaign targeting users in Mexico, which accounted for 40% of observed detections. This malware, originating from Brazil, employs DLL sideloading techniques using the legitimate Duplicate Files Finder application to execute malicious payloads. Despite a significant law enforcement operation in January 2024 that disrupted part of its infrastructure, Grandoreiro remains active and continues to evolve. The malware's initial delivery vector is suspected to involve spam campaigns, with the use of an invoice-like ZIP file. The trojan incorporates extensive anti-analysis checks to evade detection, complicating reverse engineering efforts. Recent telemetry indicates ongoing activity across Latin America, with smaller detection clusters in Europe and North America.

Key Points: • Grandoreiro targets users in Mexico, making up 40% of recent detections. • The malware uses DLL sideloading through the legitimate Duplicate Files Finder application. • Despite previous disruptions, Grandoreiro continues to evolve and remains active in Latin America.