{
  "family": "bancteian",
  "sample_count": 91,
  "category": "downloader",
  "description": "Bancteian (cataloged across security vendors under signatures including Trojan:Win32/Bancteian, TrojanDownloader:Win32/Bancteian, and Trojan.Bancteian) is a specialized Windows trojan downloader and staging agent active since 2015. Closely associated with the Latin American Banload banking malware ecosystem, Bancteian is deployed as a stealth initial stager designed to compromise host systems and download complex secondary banking trojans (such as members of the Banker and Guildma families). Delivered primarily via spearphishing emails disguised as judicial notifications, unpaid utility invoices, or electronic tax documents, Bancteian arrives inside password-protected ZIP archives containing deceptive LNK files, VBScripts, or weaponized PDF documents. Upon execution, Bancteian deploys anti-sandbox sleep routines, interrogates host language settings and keyboard layouts to confirm geographical targets (frequently Brazil and other South American regions), and connects to remote C2 servers to fetch, decrypt, and execute secondary banking overlay trojans designed to steal online banking credentials.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Bancteian",
    "TrojanDownloader:Win32/Bancteian",
    "Win32/Bancteian",
    "Trojan.Bancteian"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is TrojanDownloader:Win32/Bancteian?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Bancteian is a banking trojan downloader that stages secondary infostealers and financial malware."
      }
    },
    {
      "@type": "Question",
      "name": "Which region is most frequently targeted by Bancteian?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It primarily targets financial institutions and banking customers in Latin America, notably Brazil."
      }
    },
    {
      "@type": "Question",
      "name": "How does Bancteian infiltrate target workstations?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through spearphishing emails disguised as legal summons or unpaid invoices carrying malicious ZIP archives and scripts."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads are staged by Bancteian?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It downloads banking overlay trojans, browser form-grabbers, keystroke loggers, and credential stealing frameworks."
      }
    },
    {
      "@type": "Question",
      "name": "How should security teams respond to a Bancteian detection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint, block external C2 IP addresses at the firewall, run full offline remediation, and immediately reset online banking credentials."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.001",
    "T1204.002",
    "T1059.003",
    "T1547.001",
    "T1105",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1185",
      "name": "Browser Session Hijacking",
      "tactic": "Collection"
    },
    {
      "id": "T1056.004",
      "name": "Input Capture: Credential API Hooking",
      "tactic": "Credential Access"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1110",
      "name": "Brute Force",
      "tactic": "Credential Access"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network to halt the active exfiltration of banking credentials and prevent interactive MitB sessions.",
    "Assist the user in immediately contacting their financial institutions to freeze accounts, block recent transactions, and reset all passwords.",
    "Capture a live memory image (RAM dump) to extract the injected Bancteian DLLs and the downloaded web-inject configuration files.",
    "Perform a clean OS rebuild; banking trojans establish deep, complex hooks in the browser that are extremely difficult to eradicate manually."
  ],
  "what_to_avoid": [
    "Do not allow the user to access any online banking or financial portals while the machine is infected.",
    "Avoid rebooting the machine before capturing memory, as the critical web-inject configurations and stolen session tokens exist only in RAM."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Financial Theft",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2015,
  "threat_actor": null,
  "delivery_mechanism": [
    "Spearphishing Emails with Malicious ZIPs",
    "Deceptive Invoices & Court Summons",
    "VBScript and LNK Droppers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Initial Access Staging",
    "Secondary Banking Trojan Downloading",
    "Geographical Filtering",
    "Anti-Analysis Evasion",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 EXE",
      "VBScript",
      "LNK Shortcut"
    ],
    "network_signatures": [
      "HTTP GET requests downloading encrypted secondary banking payloads",
      "POST beacons reporting system locale and architecture to C2"
    ],
    "evasion_techniques": [
      "Language and keyboard layout checks to verify target geography",
      "Anti-debugging and sandbox sleep evasion"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Bancteian",
      "Startup folder shortcut placement"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "Low",
    "scope": "Online banking credentials, financial accounts, secondary trojan compromise"
  },
  "lineage": {
    "derived_from": [
      "Banload Banking Trojan Family"
    ],
    "variants": [
      "Bancteian.A",
      "Bancteian.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b7c6d",
      "3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3a2b"
    ],
    "delivery": [
      "notificacao_judicial.zip",
      "fatura_pendente.vbs"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\BancteianLoader",
      "%AppData%\\Bancteian\\bank_update.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Bancteian",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Bancteian"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Banload",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.banload"
    }
  ]
}