MITRE ATT&CKsoftware (malware)
S0455 Metamorfo
- Domain
- enterprise
- Platforms
- Windows
- Aliases
- Casbaneiro
- Version
- 2.1
- Created
- 2020-05-26
Description
Metamorfo is a Latin-American banking trojan operated by a Brazilian cybercrime group that has been active since at least April 2018. The group focuses on targeting banks and cryptocurrency services in Brazil and Mexico.
Related
Uses · MITRE ATT&CK (46)
- T1685 Disable or Modify Tools technique
- T1027.013 Encrypted/Encoded File sub-technique
- T1059.007 JavaScript sub-technique
- T1573.001 Symmetric Cryptography sub-technique
- T1573.002 Asymmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1102.001 Dead Drop Resolver sub-technique
- T1102.003 One-Way Communication sub-technique
- T1571 Non-Standard Port technique
- T1564.003 Hidden Window sub-technique
- T1574.001 DLL sub-technique
- T1204.002 Malicious File sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.005 Visual Basic sub-technique
- T1565.002 Transmitted Data Manipulation sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1518.001 Security Software Discovery sub-technique
- T1056.001 Keylogging sub-technique
- T1056.002 GUI Input Capture sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1027.002 Software Packing sub-technique
- T1553.002 Code Signing sub-technique
- T1070.004 File Deletion sub-technique
- T1218.007 Msiexec sub-technique
- T1218.005 Mshta sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1055.001 Dynamic-link Library Injection sub-technique
- T1518 Software Discovery technique
- T1497 Virtualization/Sandbox Evasion technique
- T1140 Deobfuscate/Decode Files or Information technique
References
- https://medium.com/@chenerlich/the-avast-abuser-metamorfo-banking-malware-hides-by-abusing-avast-executable-ac9b8b392767 Medium Metamorfo Apr 2020
- https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/ ESET Casbaneiro Oct 2019