{
  "family": "banbra",
  "sample_count": 53,
  "category": "banking_trojan",
  "description": "Banbra (cataloged across security vendors and threat intelligence databases under signatures including Trojan-Banker.Win32.Banbra, Trojan:Win32/Banbra, and Win32/Banbra) is a classic and widespread Brazilian banking trojan downloader family active since 2003. Closely aligned with the Bancos and Banker malware syndicates, Banbra is engineered to compromise Windows endpoints across Brazil and Latin America. The malware is distributed via Portuguese-language phishing emails purporting to be judicial subpoenas, tax notifications (Receita Federal), utility bills, or bank security notices containing malicious links or weaponized attachments. Upon infection, Banbra fingerprints the target host, disables Windows security prompts and antivirus services, and connects to remote C2 staging servers over HTTP to download specialized secondary banking overlay modules. When users access supported online banking services, Banbra injects deceptive credential collection forms and keyloggers to hijack account credentials, payment card numbers, and security tokens.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan-Banker.Win32.Banbra",
    "Trojan:Win32/Banbra",
    "Win32/Banbra",
    "Banbra Downloader"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan-Banker.Win32.Banbra?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Banbra is a Brazilian banking trojan downloader designed to steal credentials for Latin American banks."
      }
    },
    {
      "@type": "Question",
      "name": "How is Banbra distributed to victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Via Portuguese phishing emails disguised as fake court subpoenas, utility bills, or tax invoices."
      }
    },
    {
      "@type": "Question",
      "name": "What actions does Banbra perform after execution?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It checks host parameters, disables security tools, and downloads secondary banking overlay modules from remote servers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Banbra capture banking credentials?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It monitors browser navigation to banks and presents fake overlays to capture passwords and security tokens."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be defended against Banbra trojans?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Implement email phishing protections, maintain endpoint detection with behavioral heuristics, and verify banking certificates."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.002",
    "T1105",
    "T1056.002",
    "T1547.001",
    "T1562.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1185",
      "name": "Browser Session Hijacking",
      "tactic": "Collection"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1568.002",
      "name": "Dynamic Resolution: Domain Generation Algorithms",
      "tactic": "Command and Control"
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol",
      "tactic": "Exfiltration"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network to halt the active credential harvesting and prevent the attacker from maintaining a live session with the bank.",
    "Assume all financial credentials used on the machine are compromised; initiate mandatory password resets and contact relevant banking institutions immediately.",
    "Capture a forensic memory image to extract the active Banbra configuration, identifying exactly which financial institutions were targeted.",
    "Due to the aggressive credential harvesting, a complete, clean rebuild of the operating system is the most secure remediation."
  ],
  "what_to_avoid": [
    "Do not allow the user to type any passwords or access sensitive portals while the machine is infected.",
    "Avoid relying solely on basic AV removal, as Banbra frequently updates its persistence mechanisms and drops secondary payloads."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Financial Theft",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2003,
  "threat_actor": null,
  "delivery_mechanism": [
    "Portuguese Phishing Emails",
    "Deceptive Tax & Subpoena Notifications",
    "Malicious URL Links & Redirects"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Secondary Banking Module Downloading",
    "Deceptive Form Overlay Injection",
    "Antivirus Process Disablement",
    "Host Profile Fingerprinting",
    "Keystroke & Token Logging"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Delphi)",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP GET requests downloading encrypted secondary banking payloads from remote file hosts",
      "HTTP POST beacons transmitting harvested banking credentials to drop boxes"
    ],
    "evasion_techniques": [
      "Delphi binary packing and API redirection",
      "Disabling Windows Defender and local security mechanisms",
      "Anti-debugging loops verifying human mouse interactions"
    ],
    "indicators": {
      "file_paths": [
        "%AppData%\\Banbra\\down.exe",
        "%Temp%\\module_bank.dll"
      ],
      "registry_keys": [
        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\BanbraDownloader"
      ]
    }
  },
  "severity": "critical",
  "lineage": {
    "derived_from": [
      "Brazilian Banker Stagers"
    ],
    "variants": [
      "Banbra.A",
      "Banbra.Gen",
      "Banbra.Downloader"
    ]
  },
  "iocs": {
    "file_hashes": [
      "23456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef01",
      "3456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef012"
    ],
    "delivery": [
      "notificacao_judicial_eletronica.exe",
      "fatura_energia_segunda_via.scr"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\BanbraDownloader"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan-Banker:Win32/Banbra",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan-Banker:Win32/Banbra"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.BANBRA",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.banbra"
    }
  ]
}