{"id":8372,"date":"2020-04-28T15:02:00","date_gmt":"2020-04-28T07:02:00","guid":{"rendered":"https:\/\/version-2.com\/?p=8372"},"modified":"2020-11-04T13:23:12","modified_gmt":"2020-11-04T05:23:12","slug":"eset-investigates-grandoreiro-a-trojan-exploiting-the-coronavirus-pandemic","status":"publish","type":"post","link":"https:\/\/version-2.com\/en\/2020\/04\/eset-investigates-grandoreiro-a-trojan-exploiting-the-coronavirus-pandemic\/","title":{"rendered":"ESET investigates Grandoreiro, a trojan exploiting the coronavirus pandemic"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

BRATISLAVA<\/b>, PRAGUE – As part of an ongoing series on Latin American banking trojans, ESET researchers take an in-depth look at Grandoreiro. This trojan targets users especially in Brazil, Mexico, Spain and Peru. Distributed almost exclusively through email spam, it has lately started to utilize fake websites capitalizing on the global coronavirus pandemic. Grandoreiro reveals a persistent effort from its authors to evade detection. Although ESET has seen Grandoreiro primarily distributed through spam, where the authors usually utilize a fake Java or Flash update, recently we have observed a shift to COVID19 related scams. The trojan was hiding in videos on fake websites promising information about the coronavirus. However, instead of playing, clicking the video leads to the download of a payload on visitors\u2019 devices.Grandoreiro has been active since at least 2017 in Brazil and Peru, expanding to Mexico and Spain in 2019. As with other Latin American banking trojans in this series, Grandoreiro attacks its victims by displaying fake pop-up windows as a ploy to get them to divulge sensitive information.<\/p>

\"\"<\/p>

The backdoor functionality of Grandoreiro includes manipulating windows; updating itself; capturing keystrokes; simulating mouse and keyboard actions; navigating browsers to chosen URLs; signing out and restarting machines; and blocking access to websites. Grandoreiro collects various information about affected machines and, in some versions, it also steals credentials stored in Google Chrome as well as data stored in Microsoft Outlook browsers.\u201cFor a Latin American banking trojan, Grandoreiro utilizes a surprisingly large number of tricks to evade detection and emulation. That includes many techniques to detect or even disable banking protection software,\u201d says ESET researcher Robert \u0160uman, leading the team analyzing Grandoreiro. \u201cThey seem to be developing the banking trojan very rapidly. Almost every new version we see introduces some changes. We also suspect they are developing at least two variants simultaneously. Interestingly, from a technical point of view, they also utilize a very specific application of the binary padding technique that makes it hard to get rid of the padding while keeping a valid file,\u201d adds \u0160uman.Unlike the majority of Latin American banking trojans, Grandoreiro utilizes quite small distribution chains. For different campaigns, it may choose a different type of downloader. These downloaders are often stored on well-known public online sharing services such as GitHub, Dropbox, Pastebin, 4shared or 4Sync.<\/p>

\"\"<\/p>

For more technical details about Grandoreiro, read the blogpost \u201cGrandoreiro: How engorged can an EXE get?\u201d on WeLiveSecurity.com. Make sure to follow\u00a0ESET research on Twitter<\/a>\u00a0for the latest news from ESET Research.<\/p><\/div>

\u00a0<\/p>

\u00a0<\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

About Version 2 Digital<\/h3>

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.\n

\nThrough an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t\n\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

About ESET<\/strong>
For 30 years, ESET\u00ae has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET\u2019s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24\/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single \u201cin-the-wild\u201d malware without interruption since 2003.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"

BRATISLAVA, PRAGUE – As part of an ongoing series […]<\/p>","protected":false},"author":143524195,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[131,40,61,99],"tags":[93,98,219,227,41],"class_list":["post-8372","post","type-post","status-publish","format-standard","hentry","category-v2","category-eset","category-press-release","category-year2020","tag-trojan","tag-98","tag-coronavirus","tag-grandoreiro","tag-eset"],"acf":[],"yoast_head":"\nESET investigates Grandoreiro, a trojan exploiting the coronavirus pandemic - Version 2<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/version-2.com\/en\/2020\/04\/eset-investigates-grandoreiro-a-trojan-exploiting-the-coronavirus-pandemic\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"ESET investigates Grandoreiro, a trojan exploiting the coronavirus pandemic - Version 2\" \/>\n<meta property=\"og:description\" content=\"BRATISLAVA, PRAGUE – As part of an ongoing series […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/version-2.com\/en\/2020\/04\/eset-investigates-grandoreiro-a-trojan-exploiting-the-coronavirus-pandemic\/\" \/>\n<meta property=\"og:site_name\" content=\"Version 2\" \/>\n<meta property=\"article:published_time\" content=\"2020-04-28T07:02:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-11-04T05:23:12+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/version-2.com\/wp-content\/uploads\/2020\/05\/Grandoreiro_image1.png\" \/>\n<meta name=\"author\" content=\"version2hk\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"version2hk\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/version-2.com\\\/en\\\/2020\\\/04\\\/eset-investigates-grandoreiro-a-trojan-exploiting-the-coronavirus-pandemic\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/en\\\/2020\\\/04\\\/eset-investigates-grandoreiro-a-trojan-exploiting-the-coronavirus-pandemic\\\/\"},\"author\":{\"name\":\"version2hk\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/person\\\/d14d2d3cd77ffdb618b9f1330fe084db\"},\"headline\":\"ESET investigates Grandoreiro, a trojan exploiting the coronavirus pandemic\",\"datePublished\":\"2020-04-28T07:02:00+00:00\",\"dateModified\":\"2020-11-04T05:23:12+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/en\\\/2020\\\/04\\\/eset-investigates-grandoreiro-a-trojan-exploiting-the-coronavirus-pandemic\\\/\"},\"wordCount\":429,\"publisher\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\"},\"keywords\":[\"trojan\",\"2020\",\"coronavirus\",\"Grandoreiro\",\"ESET\"],\"articleSection\":[\"Version 2 Limited\",\"ESET\",\"Press Release\",\"2020\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/version-2.com\\\/en\\\/2020\\\/04\\\/eset-investigates-grandoreiro-a-trojan-exploiting-the-coronavirus-pandemic\\\/\",\"url\":\"https:\\\/\\\/version-2.com\\\/en\\\/2020\\\/04\\\/eset-investigates-grandoreiro-a-trojan-exploiting-the-coronavirus-pandemic\\\/\",\"name\":\"ESET investigates Grandoreiro, a trojan exploiting the coronavirus pandemic - Version 2\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#website\"},\"datePublished\":\"2020-04-28T07:02:00+00:00\",\"dateModified\":\"2020-11-04T05:23:12+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/en\\\/2020\\\/04\\\/eset-investigates-grandoreiro-a-trojan-exploiting-the-coronavirus-pandemic\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/version-2.com\\\/en\\\/2020\\\/04\\\/eset-investigates-grandoreiro-a-trojan-exploiting-the-coronavirus-pandemic\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/version-2.com\\\/en\\\/2020\\\/04\\\/eset-investigates-grandoreiro-a-trojan-exploiting-the-coronavirus-pandemic\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9801\",\"item\":\"https:\\\/\\\/version-2.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"ESET investigates Grandoreiro, a trojan exploiting the coronavirus pandemic\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#website\",\"url\":\"https:\\\/\\\/version-2.com\\\/zh\\\/\",\"name\":\"Version 2\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/version-2.com\\\/zh\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\",\"name\":\"Version 2\",\"url\":\"https:\\\/\\\/version-2.com\\\/zh\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/version-2.com\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/version-2.com\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1\",\"width\":1795,\"height\":335,\"caption\":\"Version 2\"},\"image\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/person\\\/d14d2d3cd77ffdb618b9f1330fe084db\",\"name\":\"version2hk\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g\",\"caption\":\"version2hk\"},\"sameAs\":[\"http:\\\/\\\/version2xfortcom.wordpress.com\"],\"url\":\"https:\\\/\\\/version-2.com\\\/en\\\/author\\\/version2hk\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"ESET investigates Grandoreiro, a trojan exploiting the coronavirus pandemic - Version 2","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/version-2.com\/en\/2020\/04\/eset-investigates-grandoreiro-a-trojan-exploiting-the-coronavirus-pandemic\/","og_locale":"en_US","og_type":"article","og_title":"ESET investigates Grandoreiro, a trojan exploiting the coronavirus pandemic - Version 2","og_description":"BRATISLAVA, PRAGUE – As part of an ongoing series […]","og_url":"https:\/\/version-2.com\/en\/2020\/04\/eset-investigates-grandoreiro-a-trojan-exploiting-the-coronavirus-pandemic\/","og_site_name":"Version 2","article_published_time":"2020-04-28T07:02:00+00:00","article_modified_time":"2020-11-04T05:23:12+00:00","og_image":[{"url":"https:\/\/version-2.com\/wp-content\/uploads\/2020\/05\/Grandoreiro_image1.png","type":"","width":"","height":""}],"author":"version2hk","twitter_card":"summary_large_image","twitter_misc":{"Written by":"version2hk","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/version-2.com\/en\/2020\/04\/eset-investigates-grandoreiro-a-trojan-exploiting-the-coronavirus-pandemic\/#article","isPartOf":{"@id":"https:\/\/version-2.com\/en\/2020\/04\/eset-investigates-grandoreiro-a-trojan-exploiting-the-coronavirus-pandemic\/"},"author":{"name":"version2hk","@id":"https:\/\/version-2.com\/zh\/#\/schema\/person\/d14d2d3cd77ffdb618b9f1330fe084db"},"headline":"ESET investigates Grandoreiro, a trojan exploiting the coronavirus pandemic","datePublished":"2020-04-28T07:02:00+00:00","dateModified":"2020-11-04T05:23:12+00:00","mainEntityOfPage":{"@id":"https:\/\/version-2.com\/en\/2020\/04\/eset-investigates-grandoreiro-a-trojan-exploiting-the-coronavirus-pandemic\/"},"wordCount":429,"publisher":{"@id":"https:\/\/version-2.com\/zh\/#organization"},"keywords":["trojan","2020","coronavirus","Grandoreiro","ESET"],"articleSection":["Version 2 Limited","ESET","Press Release","2020"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/version-2.com\/en\/2020\/04\/eset-investigates-grandoreiro-a-trojan-exploiting-the-coronavirus-pandemic\/","url":"https:\/\/version-2.com\/en\/2020\/04\/eset-investigates-grandoreiro-a-trojan-exploiting-the-coronavirus-pandemic\/","name":"ESET investigates Grandoreiro, a trojan exploiting the coronavirus pandemic - Version 2","isPartOf":{"@id":"https:\/\/version-2.com\/zh\/#website"},"datePublished":"2020-04-28T07:02:00+00:00","dateModified":"2020-11-04T05:23:12+00:00","breadcrumb":{"@id":"https:\/\/version-2.com\/en\/2020\/04\/eset-investigates-grandoreiro-a-trojan-exploiting-the-coronavirus-pandemic\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/version-2.com\/en\/2020\/04\/eset-investigates-grandoreiro-a-trojan-exploiting-the-coronavirus-pandemic\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/version-2.com\/en\/2020\/04\/eset-investigates-grandoreiro-a-trojan-exploiting-the-coronavirus-pandemic\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9801","item":"https:\/\/version-2.com\/"},{"@type":"ListItem","position":2,"name":"ESET investigates Grandoreiro, a trojan exploiting the coronavirus pandemic"}]},{"@type":"WebSite","@id":"https:\/\/version-2.com\/zh\/#website","url":"https:\/\/version-2.com\/zh\/","name":"Version 2","description":"","publisher":{"@id":"https:\/\/version-2.com\/zh\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/version-2.com\/zh\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/version-2.com\/zh\/#organization","name":"Version 2","url":"https:\/\/version-2.com\/zh\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/version-2.com\/zh\/#\/schema\/logo\/image\/","url":"https:\/\/i0.wp.com\/version-2.com\/wp-content\/uploads\/2020\/08\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1","contentUrl":"https:\/\/i0.wp.com\/version-2.com\/wp-content\/uploads\/2020\/08\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1","width":1795,"height":335,"caption":"Version 2"},"image":{"@id":"https:\/\/version-2.com\/zh\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/version-2.com\/zh\/#\/schema\/person\/d14d2d3cd77ffdb618b9f1330fe084db","name":"version2hk","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g","caption":"version2hk"},"sameAs":["http:\/\/version2xfortcom.wordpress.com"],"url":"https:\/\/version-2.com\/en\/author\/version2hk\/"}]}},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/pbQRKm-2b2","post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts\/8372","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/users\/143524195"}],"replies":[{"embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/comments?post=8372"}],"version-history":[{"count":10,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts\/8372\/revisions"}],"predecessor-version":[{"id":18525,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts\/8372\/revisions\/18525"}],"wp:attachment":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/media?parent=8372"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/categories?post=8372"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/tags?post=8372"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}