{
  "family": "bancos",
  "sample_count": 55,
  "category": "banking_trojan",
  "description": "Bancos (cataloged across security vendors and threat intelligence databases under signatures including Trojan-Banker.Win32.Bancos, Trojan:Win32/Bancos, and Win32/Bancos) is an enduring and pervasive family of Brazilian banking trojans active since 2003. Specifically targeting customers of Brazilian, Latin American, and Portuguese financial institutions, Bancos is distributed primarily through targeted phishing emails with malicious links, weaponized documents, and fake banking security certificate downloads. Upon execution, Bancos hooks Windows APIs and web browser processes, continuously monitoring open browser window titles for strings associated with major banking portals (including Banco do Brasil, Bradesco, Itaú, Santander, and Caixa Econômica Federal). When a victim navigates to a targeted bank, Bancos overlays deceptive, pixel-perfect fake authentication windows or keypad capture forms designed to harvest account numbers, electronic passwords, and multi-factor transaction authentication numbers (TANs). The stolen credentials are immediately exfiltrated to remote C2 drop sites via HTTP or SMTP. Bancos also actively modifies the Windows hosts file and installs fake digital certificates to conduct man-in-the-browser attacks while disabling local security tools like Warsaw and Trusteer Rapport.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan-Banker.Win32.Bancos",
    "Trojan:Win32/Bancos",
    "Win32/Bancos",
    "Bancos Banker"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan-Banker.Win32.Bancos?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Bancos is a Brazilian banking trojan that displays fake authentication overlay windows to steal banking credentials."
      }
    },
    {
      "@type": "Question",
      "name": "How does Bancos detect when a victim visits an online banking site?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It hooks Windows APIs and constantly inspects browser window titles for bank names and financial portal strings."
      }
    },
    {
      "@type": "Question",
      "name": "What mechanisms are used to capture customer security details?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It injects fake overlay login forms, virtual keyboard loggers, and phishing prompts requesting SMS/TAN codes."
      }
    },
    {
      "@type": "Question",
      "name": "How does Bancos tamper with network traffic on infected machines?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies the Windows hosts file and installs untrusted root certificates to perform man-in-the-browser redirection."
      }
    },
    {
      "@type": "Question",
      "name": "How can organizations protect endpoints from Bancos banking trojans?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Enforce email gateway filtering for phishing links, use endpoint detection with memory scanning, and verify hosts file integrity."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.002",
    "T1056.002",
    "T1555.003",
    "T1112",
    "T1547.001",
    "T1071.001",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1185",
      "name": "Browser Session Hijacking",
      "tactic": "Collection"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1568.002",
      "name": "Dynamic Resolution: Domain Generation Algorithms",
      "tactic": "Command and Control"
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol",
      "tactic": "Exfiltration"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network to halt the active credential harvesting and prevent the attacker from maintaining a live session with the bank.",
    "Assume all financial credentials used on the machine are compromised; initiate mandatory password resets and contact relevant banking institutions immediately.",
    "Capture a forensic memory image to extract the active Bancos configuration, identifying exactly which financial institutions were targeted.",
    "Due to the aggressive credential harvesting, a complete, clean rebuild of the operating system is the most secure remediation."
  ],
  "what_to_avoid": [
    "Do not allow the user to type any passwords or access sensitive portals while the machine is infected.",
    "Avoid relying solely on basic AV removal, as Bancos frequently updates its persistence mechanisms and drops secondary payloads."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Financial Theft",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2003,
  "threat_actor": null,
  "delivery_mechanism": [
    "Targeted Phishing Emails (Portuguese)",
    "Malicious Bank Security Certificate Links",
    "Trojanized Financial Software"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Deceptive Banking Overlay Windows",
    "Virtual Keypad Input Sniffing",
    "Windows Hosts File Manipulation",
    "Anti-Security Tool Disablement",
    "Encrypted C2 Telemetry Exfiltration"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Delphi)",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP POST requests transmitting captured banking credentials to remote C2 drop panels",
      "SMTP connections dispatching credential logs via compromised mail servers"
    ],
    "evasion_techniques": [
      "Delphi form obfuscation and string encryption",
      "Disabling Warsaw and Trusteer Rapport banking protection plugins",
      "Modifying hosts file entries for major banking domains"
    ],
    "indicators": {
      "file_paths": [
        "%AppData%\\Bancos\\banker.exe",
        "%SystemRoot%\\System32\\drivers\\etc\\hosts"
      ],
      "registry_keys": [
        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\BancosUpdater"
      ]
    }
  },
  "severity": "critical",
  "lineage": {
    "derived_from": [
      "Brazilian Banker Ecosystem"
    ],
    "variants": [
      "Bancos.A",
      "Bancos.Q",
      "Bancos.Delphi"
    ]
  },
  "iocs": {
    "file_hashes": [
      "4b5c6d7e8f90123456789abcdef0123456789abcdef0123456789abcdef01234",
      "5c6d7e8f90123456789abcdef0123456789abcdef0123456789abcdef012345"
    ],
    "delivery": [
      "comprovante_pagamento_banco.exe",
      "modulo_seguranca_bancaria.scr"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\BancosUpdater"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan-Banker:Win32/Bancos",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan-Banker:Win32/Bancos"
    },
    {
      "name": "Kaspersky Securelist - The Evolution of Brazilian Banking Trojans",
      "url": "https://securelist.com/the-evolution-of-brazilian-banking-trojans/36316/"
    }
  ]
}