{
  "family": "bestafera",
  "sample_count": 48,
  "category": "banking_trojan",
  "description": "Bestafera (cataloged across security vendors and threat intelligence databases under detections including Trojan-Banker:Win32/Bestafera, Trojan.Win32.Bestafera, and Win32/Bestafera) is a classic Brazilian banking trojan and surveillance threat active since 2004. Engineered primarily to steal online banking credentials from Brazilian financial institution accounts, Bestafera is distributed through Portuguese-language phishing emails with malicious attachments, weaponized IRC links, and infected software downloads. Once active on an endpoint, Bestafera installs keyboard hooks via SetWindowsHookEx to log keystrokes entered into web browsers and takes periodic screenshots whenever browser window titles contain strings referencing major Brazilian banks. The trojan terminates security software processes, tampers with DNS and hosts files to redirect banking traffic to phishing portals, and transmits stolen credentials to operator drop accounts via SMTP email or HTTP POST beacons.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan-Banker:Win32/Bestafera",
    "Trojan.Win32.Bestafera",
    "Win32/Bestafera",
    "Bestafera Banker"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan-Banker:Win32/Bestafera?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Bestafera is a Brazilian banking trojan that logs keystrokes and captures screenshots when banking sites are opened."
      }
    },
    {
      "@type": "Question",
      "name": "How does Bestafera detect financial activity?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It inspects browser window titles for Brazilian bank names like Bradesco, Itaú, Santander, and Caixa."
      }
    },
    {
      "@type": "Question",
      "name": "What credential theft techniques are utilized by Bestafera?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses API keyboard hooks (SetWindowsHookEx) to log keystrokes and captures desktop screenshots of virtual keypads."
      }
    },
    {
      "@type": "Question",
      "name": "How does Bestafera exfiltrate captured credentials?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Via automated SMTP emails sent through compromised webmail accounts or HTTP POST requests to drop boxes."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be disinfected from Bestafera?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Terminate the trojan process, remove autostart entries under CurrentVersion\\Run, verify hosts file integrity, and run antimalware."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.002",
    "T1056.001",
    "T1113",
    "T1112",
    "T1547.001",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to halt the active exfiltration of the captured keystrokes and screenshots.",
    "Force a global, mandatory password reset for the compromised user, prioritizing corporate VPN access, email accounts, and financial portals.",
    "Capture a full forensic memory image to extract the active Bestafera payload and identify the specific C2 infrastructure.",
    "Assume all locally typed data has been compromised; perform a clean OS rebuild to ensure the keylogger is completely eradicated."
  ],
  "what_to_avoid": [
    "Do not allow the user to type any passwords or access sensitive portals while the machine is infected.",
    "Avoid assuming the threat is contained just by removing the executable; the exfiltrated passwords must be reset globally."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Financial Fraud & Banking Credential Theft",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2004,
  "threat_actor": null,
  "delivery_mechanism": [
    "Portuguese Phishing Emails",
    "Fake Banking Security Notices",
    "Malicious Software Downloads"
  ],
  "target_platforms": [
    "Windows XP",
    "Windows 2000",
    "Windows Vista",
    "Windows 7"
  ],
  "capabilities": [
    "Browser Window Title Inspection",
    "API Keystroke Logging (SetWindowsHookEx)",
    "Banking Virtual Keypad Screen Capture",
    "Windows Hosts File Tampering",
    "SMTP & HTTP Telemetry Exfiltration"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Delphi)",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Outbound SMTP traffic dispatching encrypted credential logs to operator email inboxes",
      "HTTP POST beacons uploading PNG screenshots of virtual keypads"
    ],
    "evasion_techniques": [
      "Delphi form encryption",
      "Terminating active antivirus and personal firewall processes",
      "Altering hosts file entries for major banking domains"
    ],
    "indicators": {
      "file_paths": [
        "%SystemRoot%\\bestafera.exe",
        "%Temp%\\keylog.tmp"
      ],
      "registry_keys": [
        "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\BestaferaAgent"
      ]
    }
  },
  "severity": "high",
  "lineage": {
    "derived_from": [
      "Classic Brazilian Banker Strains"
    ],
    "variants": [
      "Bestafera.A",
      "Bestafera.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "cd23de34ef456789abcdef0123456789abcdef0123456789abcdef0123456789",
      "de34ef45fa56789abcdef0123456789abcdef0123456789abcdef0123456789a"
    ],
    "delivery": [
      "recibo_bancario_eletronico.exe",
      "extrato_conta_corrente.scr"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\BestaferaAgent"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan-Banker:Win32/Bestafera",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan-Banker:Win32/Bestafera"
    },
    {
      "name": "Kaspersky Securelist - Brazilian Banking Trojans: Bestafera",
      "url": "https://securelist.com/the-evolution-of-brazilian-banking-trojans/36316/"
    }
  ]
}