A malware family they have named Amavaldo, and focus on two campaigns they observed which targeted Mexico and Brazil. ESET have identified a number of characteristics typical of Latin American banking Trojans which includes, that they are written in Delphi, contain backdoor functionality, use long distribution chains, functionality may involve multiple components, abuse legitimate tools and software, make persistent connections to C&C servers, use little-known cryptographic algorithms, and target Spanish or Portuguese speaking countries. Latin American banking Trojans tend to use social engineering techniques rather than web-injection to steal money from victims. Infected systems are monitored for certain activity which presents an opportunity for the attackers to launch their social engineering attacks. In the past, Amavaldo had been used to target Brazilian users, but in April 2019, began to be used in attacks against Mexican users. The Amavaldo family is modular malware and the final payload ZIP file consists of three components, an executable file which is a copy of a legitimate application, an injector DLL and an encrypted banking Trojan. Amavaldo collects certain information from the victim system, newer versions communicate with the C&C server using the Delphi SecureBridge library. The beginning of the infection chain is an MSI installer, in the case of the campaign targeting Mexico, ESET believe spam emails may have been the distribution vector.
Malware Hash (MD5/SHA1/SH256)