Date: 10/14/2026
Severity: High
Summary
The Casbaneiro banking trojan (also known as Metamorfo and Ponteiro) was observed alongside a malicious Chromium extension, with both infrastructures remaining active. Initial access involved a phishing email that tricked victims into installing a remote-access client, enabling attackers to execute PowerShell commands on compromised systems. The attack deployed a Delphi payload via DLL side-loading using a signed Caphyon Advanced Installer utility (VmLauncher.exe) and a malicious DLL named zlibai.dll. The Chromium extension communicates with its C2 server over WebSockets to capture screenshots, steal cookies and credentials, monitor form fields, and inject malicious HTML overlays, managed through an operator panel branded “Painel Gangster.” The extension targets approximately 65 Portuguese and Brazilian banking portals, 11 cryptocurrency exchanges, webmail providers, and typosquatted webmail domains.
Indicators of Compromise (IOC) List
Domains/URLs | n1.youconnectedssl.digital updatehostingfree.top euromasterx.com xdrivewin.com uixfilepdfview.top locuralocuralocuraloocura.top arneighti.com knowledgerknolle.com learnflourishspace.com zytherostudio.com https://n1.youconnectedssl.digital/pt.txt https://updatehostingfree.top/w.txt https://euromasterx.com/kayaba/2.dll https://euromasterx.com/good/VmLauncher.exe |
IP Address | 216.203.21.119 190.2.184.201 216.203.20.116 65.38.121.128 134.209.200.162 142.93.109.181 45.76.69.213 45.61.136.99 |
Hash | d180a1978cd547f8aa4c387f951c720f0b2ff9641a45a8153994a8f29cfdf610
6cdf132ee130b4cec889e39e06b07559fb4119c61a62d48c03cf357f66eb8900
14ee8767d04ea427a3fa09a3c5913e21c6e60f055b8e5bdc8e270e3feb7c3e36
c14c25792af4e1552b54b4fe0aca6e405ed052b4ba4af67a439bfdad5b3919ed
36f7a35c3e811fc1f66836297bc7a5d1dcc8443e7873a6369fb6d5e99351d26a
d2ae1aca06c35bd3b80f33754394aad246f81bde8040d78122c90be72753c648
91b9e6fc3e4e95626c725cf309ecd7c5de750a8e77fd9a91af51db33176509da
06354cd12cb57cd2c461f4f7dfbab68864e5dd2500a9da6bdc67d8b672fb0bbf
f91e37f4951dfd606c0faf9b77aa4e640f735a92319f10e572941e647a9b991d
b6b3e02ca585f52289206f057f0b9f0f58ad519c23471f2a03cafb69b2c8cf00
f4f4c0cfeee5492ed2bedee11747aebf734cb46bcd5a06fe9afd326906179fd1
8751a7f6a2e7abc8de41b94fcc25406efe347a2942ade15c5fb975b8e6375479
52d6cca1a8d0b06367aa82338fa47c0c6b046dd1b90195773b39ae5123754b24
44240e23989532ede8003f809d3db830de4752566d1a36e239a69e565e213e1d
b3a4d98b2258ae935924207c6727f32bd60a6c38f6ea0dfeb0ab9c86763ea7bd
6232b958294770b6ab92247eb321a63117ce7c70
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "uixfilepdfview.top" or url like "uixfilepdfview.top" or siteurl like "uixfilepdfview.top" or domainname like "xdrivewin.com" or url like "xdrivewin.com" or siteurl like "xdrivewin.com" or domainname like "locuralocuralocuraloocura.top" or url like "locuralocuralocuraloocura.top" or siteurl like "locuralocuralocuraloocura.top" or domainname like "https://euromasterx.com/kayaba/2.dll" or url like "https://euromasterx.com/kayaba/2.dll" or siteurl like "https://euromasterx.com/kayaba/2.dll" or domainname like "https://updatehostingfree.top/w.txt" or url like "https://updatehostingfree.top/w.txt" or siteurl like "https://updatehostingfree.top/w.txt" or domainname like "updatehostingfree.top" or url like "updatehostingfree.top" or siteurl like "updatehostingfree.top" or domainname like "learnflourishspace.com" or url like "learnflourishspace.com" or siteurl like "learnflourishspace.com" or domainname like "knowledgerknolle.com" or url like "knowledgerknolle.com" or siteurl like "knowledgerknolle.com" or domainname like "zytherostudio.com" or url like "zytherostudio.com" or siteurl like "zytherostudio.com" or domainname like "arneighti.com" or url like "arneighti.com" or siteurl like "arneighti.com" or domainname like "https://euromasterx.com/good/VmLauncher.exe" or url like "https://euromasterx.com/good/VmLauncher.exe" or siteurl like "https://euromasterx.com/good/VmLauncher.exe" or domainname like "euromasterx.com" or url like "euromasterx.com" or siteurl like "euromasterx.com" or domainname like "n1.youconnectedssl.digital" or url like "n1.youconnectedssl.digital" or siteurl like "n1.youconnectedssl.digital" or domainname like "https://n1.youconnectedssl.digital/pt.txt" or url like "https://n1.youconnectedssl.digital/pt.txt" or siteurl like "https://n1.youconnectedssl.digital/pt.txt" |
Detection Query 2 : | dstipaddress IN ("190.2.184.201","134.209.200.162","45.61.136.99","216.203.20.116","65.38.121.128","45.76.69.213","142.93.109.181","216.203.21.119") or srcipaddress IN ("190.2.184.201","134.209.200.162","45.61.136.99","216.203.20.116","65.38.121.128","45.76.69.213","142.93.109.181","216.203.21.119") |
Detection Query 3 : | sha256hash IN ("c14c25792af4e1552b54b4fe0aca6e405ed052b4ba4af67a439bfdad5b3919ed","14ee8767d04ea427a3fa09a3c5913e21c6e60f055b8e5bdc8e270e3feb7c3e36","36f7a35c3e811fc1f66836297bc7a5d1dcc8443e7873a6369fb6d5e99351d26a","91b9e6fc3e4e95626c725cf309ecd7c5de750a8e77fd9a91af51db33176509da","52d6cca1a8d0b06367aa82338fa47c0c6b046dd1b90195773b39ae5123754b24","44240e23989532ede8003f809d3db830de4752566d1a36e239a69e565e213e1d","f4f4c0cfeee5492ed2bedee11747aebf734cb46bcd5a06fe9afd326906179fd1","b6b3e02ca585f52289206f057f0b9f0f58ad519c23471f2a03cafb69b2c8cf00","06354cd12cb57cd2c461f4f7dfbab68864e5dd2500a9da6bdc67d8b672fb0bbf","8751a7f6a2e7abc8de41b94fcc25406efe347a2942ade15c5fb975b8e6375479","d2ae1aca06c35bd3b80f33754394aad246f81bde8040d78122c90be72753c648","f91e37f4951dfd606c0faf9b77aa4e640f735a92319f10e572941e647a9b991d","d180a1978cd547f8aa4c387f951c720f0b2ff9641a45a8153994a8f29cfdf610","6cdf132ee130b4cec889e39e06b07559fb4119c61a62d48c03cf357f66eb8900","b3a4d98b2258ae935924207c6727f32bd60a6c38f6ea0dfeb0ab9c86763ea7bd") |
Detection Query 4 : | sha1hash IN ("6232b958294770b6ab92247eb321a63117ce7c70") |
Detection Query 5 : | datasourcename = "Windows Security" and eventtype = "4663" and (objectname like "C:\Docstar\zlibai.dll" or objectname like "C:\Docstar\VmLauncher.exe" or objectname like "C:\Backup11\ptpt.zip" or objectname like "C:\chrome\background.js" or objectname like "C:\chrome\content_script.js" or objectname like "C:\chrome\manifest.json") |
Detection Query 6 : | technologygroup = "EDR" and (objectname like "C:\Docstar\zlibai.dll" or objectname like "C:\Docstar\VmLauncher.exe" or objectname like "C:\Backup11\ptpt.zip" or objectname like "C:\chrome\background.js" or objectname like "C:\chrome\content_script.js" or objectname like "C:\chrome\manifest.json") |
Detection Query 7 : | datasourcename = "Windows Security" and eventtype = "4657" and (objectname like "HKLM\SYSTEM\ControlSet001\Services\ScreenConnect Client (<%>)" or objectname like "HKCU\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings") |
Detection Query 8 : | technologygroup = "EDR" and (objectname like "HKLM\SYSTEM\ControlSet001\Services\ScreenConnect Client (<%>)" or objectname like "HKCU\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings") |
Reference:
Casbaneiro Banking Trojan