Casbaneiro Malware Hides C2 Activity Until Victims Visit Banking Websites
AI summary · grok-4.7Summaries by Vani AI
Casbaneiro hides its main command channel until Latin American victims open targeted banking sites.
FortiGuard Labs reported an August 2026 Casbaneiro campaign targeting banking users in Argentina, Peru, Colombia, and Mexico. Phishing emails and invoice or legal PDFs lead to a region-filtered download of an HTA that fetches JavaScript, then an AutoIt interpreter, script, and compressed payload. The trojan collects Outlook contacts and message metadata, registers victims, and withholds its main command channel until the user opens a targeted bank site, where commands include keyboard and clipboard control, file and command execution, and fake banking windows.
Key facts
- Phishing PDFs and links deliver a ZIP with an HTA after a country IP check.
- AutoIt loader uses a Startup shortcut and injects into RegSvcs.exe or mobsync.exe.
- Outlook contacts and message metadata leave before the main banking C2 opens.
- Remote-control commands activate only after a visit to a targeted bank site.
- Fortinet says an HTTP 403 is an expected signal, not proof the server is dead.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1204.002 Malicious FileT1547.001 Registry Run Keys / Startup FolderT1055 Process InjectionT1114.001 Local Email Collection
- Products
- WindowsAutoItMicrosoft Outlook
- Organizations
- FortinetFortiGuard Labs
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | gexwalltool.com | omain 76[.]180[.]62[.]50[.]host[.]secureserver[.]net Domain gexwalltool[.]com Domain x-wolverine[.]servebbs[.]com IP address 72[.]167[. |
| domain | x-wolverine.servebbs.com | .]host[.]secureserver[.]net Domain gexwalltool[.]com Domain x-wolverine[.]servebbs[.]com IP address 72[.]167[.]48[.]63 IP address 209[.]99[.]188 |
| ipv4 | 209.99.188.28 | e[.]servebbs[.]com IP address 72[.]167[.]48[.]63 IP address 209[.]99[.]188[.]28 Source: Fortinet’s published network indicators. Cryp |
| ipv4 | 72.167.48.63 | lltool[.]com Domain x-wolverine[.]servebbs[.]com IP address 72[.]167[.]48[.]63 IP address 209[.]99[.]188[.]28 Source: Fortinet’s pub |
| sha256 | 0849a6b87fbef25089ad0be746f84047b080ba81898a8614da43d4ab60ef735a | 9b0089a2558aa4e42bd9fb5558e1b17917e2e183a4bd9cbcb2ed77e PDF 0849a6b87fbef25089ad0be746f84047b080ba81898a8614da43d4ab60ef735a Email debe871710268e7bb770b72c6772f2e0b8bd40a22b2eabf4b6556 |
| sha256 | 0b4d962eef2d06abfe08a8cd0b15edd224d4fae0b57d708aebd77d99667616d5 | e2d605c82bb7831d2ebdfb17cb2659880e1a8a7b0a2dd851dc5e7a3 PDF 0b4d962eef2d06abfe08a8cd0b15edd224d4fae0b57d708aebd77d99667616d5 PDF c521b3a189b0089a2558aa4e42bd9fb5558e1b17917e2e183a4bd9c |
| sha256 | 1b4d5c95f4fc037ca3c359cea5ca2da1285bbadab12bcdcb47f3dad8bc6fa8ed | ca90c65223a907f23fae5d068904a2145348b953b1d06e2eaf0bf2c PDF 1b4d5c95f4fc037ca3c359cea5ca2da1285bbadab12bcdcb47f3dad8bc6fa8ed PDF 62ef39ec29966d71c8254f68bd5e320cf24a042d76c12dbafdcc076 |
| sha256 | 1f1a89bef73e4866a198a08e750f96348ce2b82816a8353e9a8a574bfde5f491 | 9966d71c8254f68bd5e320cf24a042d76c12dbafdcc0766861827c5 PDF 1f1a89bef73e4866a198a08e750f96348ce2b82816a8353e9a8a574bfde5f491 PDF ea8af591fe2d605c82bb7831d2ebdfb17cb2659880e1a8a7b0a2dd8 |
| sha256 | 40d253480f752805e58c21266e40afe99afc96feea0d355732af5bea459db1dd | d02ec87b76409f69d445a93910964f8db457bafafb97a011da59e73 PDF 40d253480f752805e58c21266e40afe99afc96feea0d355732af5bea459db1dd PDF bf92a287a3d79afb73a3f2d38877ec37c22a9f4a7d6ac2e03854722 |
| sha256 | 4302586202234cdf1ca058fd3c62be0050c8155ed113f3f62337d756e6915044 | 89463a61e6ac562d034a9de4ed897714389eb6b87bb02f0bd59d565 HTA 4302586202234cdf1ca058fd3c62be0050c8155ed113f3f62337d756e6915044 HTA 85767416f8d1e73833ccaa193263d1198857308b3a1185e6f4ebc41 |
| sha256 | 4540c3af3b1d8c52256f4580dd4d002fadb8c5ff4e32e6a41fdf508455c5b697 | 66ffa52d52fa9d5f048bbb9246d3d50110c6b0c248919ad796c6fd4 HTA 4540c3af3b1d8c52256f4580dd4d002fadb8c5ff4e32e6a41fdf508455c5b697 HTA 92a1428e125f33de012c7f52fb0827be3d7e90e38a0e38083181f8c |
| sha256 | 47d321c1a232e5cdd1e39a06dadbd79114dc1a2f0f8eac289e6b653a5d126f95 | 1a4f6f764e7495f4602a00b6024ca6e1b70fe30ba3752b881574365 PDF 47d321c1a232e5cdd1e39a06dadbd79114dc1a2f0f8eac289e6b653a5d126f95 PDF d13ad6fc5fda54e65f1214e554a5123126ac7b3ce6db57566ed7bd0 |
| sha256 | 51503ce1373c7fa72a1da5c5c4b30f88c8224686669ba4b64196591414fdc64c | 1dabb5bef2a290b32a72bf63b5c42dd2a33b5a6520159b41c43b093 HTA 51503ce1373c7fa72a1da5c5c4b30f88c8224686669ba4b64196591414fdc64c HTA 5b3c2442831d4844ea6b86942f1a0ba27170018382cbc362343db63 |
| sha256 | 5a76669ec410d0b3e21112a4a6fd3207976b299ee27c5fc3d42f2673170ab95e | 1f8287900c1c3b3e8c099cef537a02949315eb768c88906b0c65add HTA 5a76669ec410d0b3e21112a4a6fd3207976b299ee27c5fc3d42f2673170ab95e HTA 8092b9de455463296898fcaf8c9955d1c00dae6812c03bba019edf9 |
| sha256 | 5b3c2442831d4844ea6b86942f1a0ba27170018382cbc362343db63717d0ff02 | 73c7fa72a1da5c5c4b30f88c8224686669ba4b64196591414fdc64c HTA 5b3c2442831d4844ea6b86942f1a0ba27170018382cbc362343db63717d0ff02 HTA 71dea06c2271a46fc2fd6092e2ba0c2f5a2cf5ca8f955ee3375e3ca |
| sha256 | 62ef39ec29966d71c8254f68bd5e320cf24a042d76c12dbafdcc0766861827c5 | 4fc037ca3c359cea5ca2da1285bbadab12bcdcb47f3dad8bc6fa8ed PDF 62ef39ec29966d71c8254f68bd5e320cf24a042d76c12dbafdcc0766861827c5 PDF 1f1a89bef73e4866a198a08e750f96348ce2b82816a8353e9a8a574 |
| sha256 | 6547736c31dabb5bef2a290b32a72bf63b5c42dd2a33b5a6520159b41c43b093 | 7213fed7bebccd9953818b102b1b25b78e5f3707e81bad5054cf4e8 HTA 6547736c31dabb5bef2a290b32a72bf63b5c42dd2a33b5a6520159b41c43b093 HTA 51503ce1373c7fa72a1da5c5c4b30f88c8224686669ba4b64196591 |
| sha256 | 6bb4372d0d02ec87b76409f69d445a93910964f8db457bafafb97a011da59e73 | mise (IoCs):- File Hashes Sample type Hash as published PDF 6bb4372d0d02ec87b76409f69d445a93910964f8db457bafafb97a011da59e73 PDF 40d253480f752805e58c21266e40afe99afc96feea0d355732af5be |
| sha256 | 6e6bd2f7566ffa52d52fa9d5f048bbb9246d3d50110c6b0c248919ad796c6fd4 | 91e3df9be29e9eeba785467aff294f5250c2eed406765032cb68756 HTA 6e6bd2f7566ffa52d52fa9d5f048bbb9246d3d50110c6b0c248919ad796c6fd4 HTA 4540c3af3b1d8c52256f4580dd4d002fadb8c5ff4e32e6a41fdf508 |
| sha256 | 711c0aa8cde078aa349fb329e3e44e4272ea66a5e651ad8a64893c76a725c859 | 373ee50d074daf84d357f8e5e62ff91c829d87f566bee453d715280 PDF 711c0aa8cde078aa349fb329e3e44e4272ea66a5e651ad8a64893c76a725c859 PDF d910e08a11a4f6f764e7495f4602a00b6024ca6e1b70fe30ba3752b |
| sha256 | 71dea06c2271a46fc2fd6092e2ba0c2f5a2cf5ca8f955ee3375e3ca66a5dc52b | 31d4844ea6b86942f1a0ba27170018382cbc362343db63717d0ff02 HTA 71dea06c2271a46fc2fd6092e2ba0c2f5a2cf5ca8f955ee3375e3ca66a5dc52b AutoIt script fc820eeb054c781693eca78fed1c418f12b27da2c7c7e |
| sha256 | 7de637539159dc17ceedb0aae783930ee68639b6d8036ef8147027c5ebca3fc8 | efa3bde0d31358b6321f7a10fc2e04f65d7407ba Casbaneiro payload 7de637539159dc17ceedb0aae783930ee68639b6d8036ef8147027c5ebca3fc8 Source: Fortinet’s published file indicators. Network Indic |
| sha256 | 7e04e86c07213fed7bebccd9953818b102b1b25b78e5f3707e81bad5054cf4e8 | 1a6bdc79fd66b8b6ee413562abf7f72ef093292c86c1e9e7c2be456 HTA 7e04e86c07213fed7bebccd9953818b102b1b25b78e5f3707e81bad5054cf4e8 HTA 6547736c31dabb5bef2a290b32a72bf63b5c42dd2a33b5a6520159b |
| sha256 | 8092b9de455463296898fcaf8c9955d1c00dae6812c03bba019edf9c059ece33 | 410d0b3e21112a4a6fd3207976b299ee27c5fc3d42f2673170ab95e HTA 8092b9de455463296898fcaf8c9955d1c00dae6812c03bba019edf9c059ece33 HTA 99fcabf7c996d6ec077ccd745a158a3a395403d6a3df9d8da179f3c |
| sha256 | 85767416f8d1e73833ccaa193263d1198857308b3a1185e6f4ebc4164db8584f | 2234cdf1ca058fd3c62be0050c8155ed113f3f62337d756e6915044 HTA 85767416f8d1e73833ccaa193263d1198857308b3a1185e6f4ebc4164db8584f HTA f1aa14ebfd2da477edba94b34f09f775485688b5958d82fcb072a83 |
| sha256 | 875e8d4137e1016b4be869e36e00a9414e89902fd5592a2fb881ebb0e4bd2f8b | 996d6ec077ccd745a158a3a395403d6a3df9d8da179f3cd5faf81b1 HTA 875e8d4137e1016b4be869e36e00a9414e89902fd5592a2fb881ebb0e4bd2f8b HTA bd724bbb27f9a71fd44f1c334b003541761071655fa585b64eed3bd |
| sha256 | 918dd413cceed3b8aeaa79e45d9d7b2030d73e2affa4339b8f9d043d08844f62 | 150c15970aa2d6b27f0b442d758594d820ec09d53d5e861fac457 Email 918dd413cceed3b8aeaa79e45d9d7b2030d73e2affa4339b8f9d043d08844f62 Email be5a110ee72ebcf1b7d9e155308a8abc606bd446f8aec1a9f33cd |
| sha256 | 92a1428e125f33de012c7f52fb0827be3d7e90e38a0e38083181f8c3312adc9c | b1d8c52256f4580dd4d002fadb8c5ff4e32e6a41fdf508455c5b697 HTA 92a1428e125f33de012c7f52fb0827be3d7e90e38a0e38083181f8c3312adc9c HTA e57409c5e1f8287900c1c3b3e8c099cef537a02949315eb768c8890 |
| sha256 | 943d63ace373ee50d074daf84d357f8e5e62ff91c829d87f566bee453d715280 | 3d79afb73a3f2d38877ec37c22a9f4a7d6ac2e0385472298f384fc8 PDF 943d63ace373ee50d074daf84d357f8e5e62ff91c829d87f566bee453d715280 PDF 711c0aa8cde078aa349fb329e3e44e4272ea66a5e651ad8a64893c7 |
| sha256 | 995b1156562150c15970aa2d6b27f0b442d758594d820ec09d53d5e861fac457 | 394ad5dcd271aa86f08cb2b8374203ecc67015af7ca6057244390 Email 995b1156562150c15970aa2d6b27f0b442d758594d820ec09d53d5e861fac457 Email 918dd413cceed3b8aeaa79e45d9d7b2030d73e2affa4339b8f9d0 |
| sha256 | 99fcabf7c996d6ec077ccd745a158a3a395403d6a3df9d8da179f3cd5faf81b1 | 55463296898fcaf8c9955d1c00dae6812c03bba019edf9c059ece33 HTA 99fcabf7c996d6ec077ccd745a158a3a395403d6a3df9d8da179f3cd5faf81b1 HTA 875e8d4137e1016b4be869e36e00a9414e89902fd5592a2fb881ebb |
| sha256 | a42daeca71a6bdc79fd66b8b6ee413562abf7f72ef093292c86c1e9e7c2be456 | 7f9a71fd44f1c334b003541761071655fa585b64eed3bd78fc28e01 HTA a42daeca71a6bdc79fd66b8b6ee413562abf7f72ef093292c86c1e9e7c2be456 HTA 7e04e86c07213fed7bebccd9953818b102b1b25b78e5f3707e81bad |
| sha256 | bd724bbb27f9a71fd44f1c334b003541761071655fa585b64eed3bd78fc28e01 | 7e1016b4be869e36e00a9414e89902fd5592a2fb881ebb0e4bd2f8b HTA bd724bbb27f9a71fd44f1c334b003541761071655fa585b64eed3bd78fc28e01 HTA a42daeca71a6bdc79fd66b8b6ee413562abf7f72ef093292c86c1e9 |
| sha256 | be5a110ee72ebcf1b7d9e155308a8abc606bd446f8aec1a9f33cd06ca0f3c056 | ed3b8aeaa79e45d9d7b2030d73e2affa4339b8f9d043d08844f62 Email be5a110ee72ebcf1b7d9e155308a8abc606bd446f8aec1a9f33cd06ca0f3c056 Email dc62e645589463a61e6ac562d034a9de4ed897714389eb6b87bb0 |
| sha256 | bf92a287a3d79afb73a3f2d38877ec37c22a9f4a7d6ac2e0385472298f384fc8 | f752805e58c21266e40afe99afc96feea0d355732af5bea459db1dd PDF bf92a287a3d79afb73a3f2d38877ec37c22a9f4a7d6ac2e0385472298f384fc8 PDF 943d63ace373ee50d074daf84d357f8e5e62ff91c829d87f566bee4 |
| sha256 | c477bdfae91e3df9be29e9eeba785467aff294f5250c2eed406765032cb68756 | d2da477edba94b34f09f775485688b5958d82fcb072a837e27e246b HTA c477bdfae91e3df9be29e9eeba785467aff294f5250c2eed406765032cb68756 HTA 6e6bd2f7566ffa52d52fa9d5f048bbb9246d3d50110c6b0c248919a |
| sha256 | c521b3a189b0089a2558aa4e42bd9fb5558e1b17917e2e183a4bd9cbcb2ed77e | f2d06abfe08a8cd0b15edd224d4fae0b57d708aebd77d99667616d5 PDF c521b3a189b0089a2558aa4e42bd9fb5558e1b17917e2e183a4bd9cbcb2ed77e PDF 0849a6b87fbef25089ad0be746f84047b080ba81898a8614da43d4a |
| sha256 | d04f68079ca90c65223a907f23fae5d068904a2145348b953b1d06e2eaf0bf2c | fda54e65f1214e554a5123126ac7b3ce6db57566ed7bd0e92d03d85 PDF d04f68079ca90c65223a907f23fae5d068904a2145348b953b1d06e2eaf0bf2c PDF 1b4d5c95f4fc037ca3c359cea5ca2da1285bbadab12bcdcb47f3dad |
| sha256 | d13ad6fc5fda54e65f1214e554a5123126ac7b3ce6db57566ed7bd0e92d03d85 | 232e5cdd1e39a06dadbd79114dc1a2f0f8eac289e6b653a5d126f95 PDF d13ad6fc5fda54e65f1214e554a5123126ac7b3ce6db57566ed7bd0e92d03d85 PDF d04f68079ca90c65223a907f23fae5d068904a2145348b953b1d06e |
| sha256 | d910e08a11a4f6f764e7495f4602a00b6024ca6e1b70fe30ba3752b881574365 | de078aa349fb329e3e44e4272ea66a5e651ad8a64893c76a725c859 PDF d910e08a11a4f6f764e7495f4602a00b6024ca6e1b70fe30ba3752b881574365 PDF 47d321c1a232e5cdd1e39a06dadbd79114dc1a2f0f8eac289e6b653 |
| sha256 | dc62e645589463a61e6ac562d034a9de4ed897714389eb6b87bb02f0bd59d565 | ebcf1b7d9e155308a8abc606bd446f8aec1a9f33cd06ca0f3c056 Email dc62e645589463a61e6ac562d034a9de4ed897714389eb6b87bb02f0bd59d565 HTA 4302586202234cdf1ca058fd3c62be0050c8155ed113f3f62337d75 |
| sha256 | debe871710268e7bb770b72c6772f2e0b8bd40a22b2eabf4b6556eaba2d71057 | ef25089ad0be746f84047b080ba81898a8614da43d4ab60ef735a Email debe871710268e7bb770b72c6772f2e0b8bd40a22b2eabf4b6556eaba2d71057 Email eaec8c6950f394ad5dcd271aa86f08cb2b8374203ecc67015af7c |
| sha256 | e57409c5e1f8287900c1c3b3e8c099cef537a02949315eb768c88906b0c65add | 25f33de012c7f52fb0827be3d7e90e38a0e38083181f8c3312adc9c HTA e57409c5e1f8287900c1c3b3e8c099cef537a02949315eb768c88906b0c65add HTA 5a76669ec410d0b3e21112a4a6fd3207976b299ee27c5fc3d42f267 |
| sha256 | ea8af591fe2d605c82bb7831d2ebdfb17cb2659880e1a8a7b0a2dd851dc5e7a3 | 73e4866a198a08e750f96348ce2b82816a8353e9a8a574bfde5f491 PDF ea8af591fe2d605c82bb7831d2ebdfb17cb2659880e1a8a7b0a2dd851dc5e7a3 PDF 0b4d962eef2d06abfe08a8cd0b15edd224d4fae0b57d708aebd77d9 |
| sha256 | eaec8c6950f394ad5dcd271aa86f08cb2b8374203ecc67015af7ca6057244390 | 68e7bb770b72c6772f2e0b8bd40a22b2eabf4b6556eaba2d71057 Email eaec8c6950f394ad5dcd271aa86f08cb2b8374203ecc67015af7ca6057244390 Email 995b1156562150c15970aa2d6b27f0b442d758594d820ec09d53d |
| sha256 | f1aa14ebfd2da477edba94b34f09f775485688b5958d82fcb072a837e27e246b | 8d1e73833ccaa193263d1198857308b3a1185e6f4ebc4164db8584f HTA f1aa14ebfd2da477edba94b34f09f775485688b5958d82fcb072a837e27e246b HTA c477bdfae91e3df9be29e9eeba785467aff294f5250c2eed4067650 |
| sha256 | f76d09cbd455ce18765591b9efa3bde0d31358b6321f7a10fc2e04f65d7407ba | ca78fed1c418f12b27da2c7c7e73281eb07b25cc7d910 AutoIt script f76d09cbd455ce18765591b9efa3bde0d31358b6321f7a10fc2e04f65d7407ba Casbaneiro payload 7de637539159dc17ceedb0aae783930ee68639b6 |
| sha256 | fc820eeb054c781693eca78fed1c418f12b27da2c7c7e73281eb07b25cc7d910 | d6092e2ba0c2f5a2cf5ca8f955ee3375e3ca66a5dc52b AutoIt script fc820eeb054c781693eca78fed1c418f12b27da2c7c7e73281eb07b25cc7d910 AutoIt script f76d09cbd455ce18765591b9efa3bde0d31358b6321f7 |
From the original article
5 min read at cybersecuritynews.com
Casbaneiro malware is hiding its main command and control traffic until an infected user visits a targeted banking website. The Windows banking trojan combines phishing messages, location checks, staged downloads, and separate data collection servers to make an active infection appear quiet during routine analysis. The campaign targets users across Latin America, with activity linked […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.