S0455: Metamorfo

S0455: Metamorfo describes [Metamorfo](https://attack.mitre.org/software/S0455) is a Latin-American banking trojan operated by a Brazilian cybercrime group that has been active since at least April 2018. The group focuses on targeting banks and cryptocurrency services in Brazil and Mexico.(Citation: Medium Metamorfo Apr 2020)(Citation: ESET Casbaneiro Oct 2019)

Executive priority

S0455: Metamorfo is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S0455: Metamorfo by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Network, endpoint, and security-tool telemetry

Detection direction

Validate whether S0455: Metamorfo appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Metamorfo

Metamorfo is a Latin-American banking trojan operated by a Brazilian cybercrime group that has been active since at least April 2018. The group focuses on targeting banks and cryptocurrency services in Brazil and Mexico.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques46 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1059.007	JavaScriptSub-technique	Metamorfo includes payloads written in JavaScript.[1]
Enterprise	T1518	Software Discovery	Metamorfo has searched the compromised system for banking applications.CitationFireEye Metamorfo Apr 2018[2]
Enterprise	T1056.001	KeyloggingSub-technique	Metamorfo has a command to launch a keylogger and capture keystrokes on the victim’s machine.CitationFortinet Metamorfo Feb 2020[2]
Enterprise	T1518.001	Security Software DiscoverySub-technique	Metamorfo collects a list of installed antivirus software from the victim’s system.CitationFortinet Metamorfo Feb 2020[2]
Enterprise	T1573.002	Asymmetric CryptographySub-technique	Metamorfo's C2 communication has been encrypted using OpenSSL.[1]
Enterprise	T1071.001	Web ProtocolsSub-technique	Metamorfo has used HTTP for C2.[1][2]
Enterprise	T1218.007	MsiexecSub-technique	Metamorfo has used MsiExec.exe to automatically execute files.CitationFortinet Metamorfo Feb 2020[2]
Enterprise	T1204.002	Malicious FileSub-technique	Metamorfo requires the user to double-click the executable to run the malicious HTA file or to download a malicious installer.CitationFireEye Metamorfo Apr 2018[2]
Enterprise	T1055.001	Dynamic-link Library InjectionSub-technique	Metamorfo has injected a malicious DLL into the Windows Media Player process (wmplayer.exe).[1]
Enterprise	T1102.001	Dead Drop ResolverSub-technique	Metamorfo has used YouTube to store and hide C&C server domains.[2]
Enterprise	T1027.013	Encrypted/Encoded FileSub-technique	Metamorfo has encrypted payloads and strings.[1][2]
Enterprise	T1106	Native API	Metamorfo has used native WINAPI calls.[1]CitationFortinet Metamorfo Feb 2020
Enterprise	T1574.001	DLLSub-technique	Metamorfo has side-loaded its malicious DLL file.[1]CitationFireEye Metamorfo Apr 2018[2]
Enterprise	T1566.001	Spearphishing AttachmentSub-technique	Metamorfo has been delivered to victims via emails with malicious HTML attachments.CitationFireEye Metamorfo Apr 2018[2]
Enterprise	T1124	System Time Discovery	Metamorfo uses JavaScript to get the system time.[1]
Enterprise	T1095	Non-Application Layer Protocol	Metamorfo has used raw TCP for C2.CitationFireEye Metamorfo Apr 2018
Enterprise	T1547.001	Registry Run Keys / Startup FolderSub-technique	Metamorfo has configured persistence to the Registry key `HKCU\Software\Microsoft\Windows\CurrentVersion\Run, Spotify =% APPDATA%\Spotify\Spotify.exe` and used .LNK files in the startup folder to achieve persistence.[1]CitationFireEye Metamorfo Apr 2018CitationFortinet Metamorfo Feb 2020[2]
Enterprise	T1041	Exfiltration Over C2 Channel	Metamorfo can send the data it collects to the C2 server.[2]
Enterprise	T1070	Indicator Removal	Metamorfo has a command to delete a Registry key it uses, `\Software\Microsoft\Internet Explorer\notes`.CitationFireEye Metamorfo Apr 2018
Enterprise	T1056.002	GUI Input CaptureSub-technique	Metamorfo has displayed fake forms on top of banking sites to intercept credentials from victims.CitationFireEye Metamorfo Apr 2018
Enterprise	T1497	Virtualization/Sandbox Evasion	Metamorfo has embedded a "vmdetect.exe" executable to identify virtual machines at the beginning of execution.[1]
Enterprise	T1070.004	File DeletionSub-technique	Metamorfo has deleted itself from the system after execution.[1]CitationFortinet Metamorfo Feb 2020
Enterprise	T1112	Modify Registry	Metamorfo has written process names to the Registry, disabled IE browser features, deleted Registry keys, and changed the ExtendedUIHoverTime key.[1]CitationFortinet Metamorfo Feb 2020CitationFireEye Metamorfo Apr 2018[2]
Enterprise	T1102.003	One-Way CommunicationSub-technique	Metamorfo has downloaded a zip file for execution on the system.[1]CitationFireEye Metamorfo Apr 2018CitationFortinet Metamorfo Feb 2020
Enterprise	T1119	Automated Collection	Metamorfo has automatically collected mouse clicks, continuous screenshots on the machine, and set timers to collect the contents of the clipboard and website browsing.CitationFireEye Metamorfo Apr 2018
Enterprise	T1571	Non-Standard Port	Metamorfo has communicated with hosts over raw TCP on port 9999.CitationFireEye Metamorfo Apr 2018
Enterprise	T1218.005	MshtaSub-technique	Metamorfo has used mshta.exe to execute a HTA payload.CitationFireEye Metamorfo Apr 2018
Enterprise	T1115	Clipboard Data	Metamorfo has a function to hijack data from the clipboard by monitoring the contents of the clipboard and replacing the cryptocurrency wallet with the attacker's.CitationFortinet Metamorfo Feb 2020[2]
Enterprise	T1129	Shared Modules	Metamorfo had used AutoIt to load and execute the DLL payload.CitationFortinet Metamorfo Feb 2020
Enterprise	T1082	System Information Discovery	Metamorfo has collected the hostname and operating system version from the compromised host.CitationFireEye Metamorfo Apr 2018CitationFortinet Metamorfo Feb 2020[2]
Enterprise	T1565.002	Transmitted Data ManipulationSub-technique	Metamorfo has a function that can watch the contents of the system clipboard for valid bitcoin addresses, which it then overwrites with the attacker's address.CitationFortinet Metamorfo Feb 2020[2]
Enterprise	T1113	Screen Capture	Metamorfo can collect screenshots of the victim’s machine.CitationFireEye Metamorfo Apr 2018[2]
Enterprise	T1553.002	Code SigningSub-technique	Metamorfo has digitally signed executables using AVAST Software certificates.[1]
Enterprise	T1059.003	Windows Command ShellSub-technique	Metamorfo has used `cmd.exe /c` to execute files.[1]
Enterprise	T1027.002	Software PackingSub-technique	Metamorfo has used VMProtect to pack and protect files.CitationFortinet Metamorfo Feb 2020
Enterprise	T1685	Disable or Modify Tools	Metamorfo has a function to kill processes associated with defenses and can prevent certain processes from launching.[1]CitationFireEye Metamorfo Apr 2018
Enterprise	T1010	Application Window Discovery	Metamorfo can enumerate all windows on the victim’s machine.CitationFireEye Metamorfo Apr 2018CitationFortinet Metamorfo Feb 2020
Enterprise	T1033	System Owner/User Discovery	Metamorfo has collected the username from the victim's machine.[2]
Enterprise	T1036.005	Match Legitimate Resource Name or LocationSub-technique	Metamorfo has disguised an MSI file as the Adobe Acrobat Reader Installer and has masqueraded payloads as OneDrive, WhatsApp, or Spotify, for example.[1][2]
Enterprise	T1105	Ingress Tool Transfer	Metamorfo has used MSI files to download additional files to execute.[1]CitationFireEye Metamorfo Apr 2018CitationFortinet Metamorfo Feb 2020[2]
Enterprise	T1057	Process Discovery	Metamorfo has performed process name checks and has monitored applications.[1]
Enterprise	T1573.001	Symmetric CryptographySub-technique	Metamorfo has encrypted C2 commands with AES-256.[2]
Enterprise	T1059.005	Visual BasicSub-technique	Metamorfo has used VBS code on victims’ systems.CitationFireEye Metamorfo Apr 2018
Enterprise	T1564.003	Hidden WindowSub-technique	Metamorfo has hidden its GUI using the ShowWindow() WINAPI call.[1]
Enterprise	T1140	Deobfuscate/Decode Files or Information	Upon execution, Metamorfo has unzipped itself after being downloaded to the system and has performed string decryption.[1]CitationFireEye Metamorfo Apr 2018[2]
Enterprise	T1083	File and Directory Discovery	Metamorfo has searched the Program Files directories for specific folders and has searched for strings related to its mutexes.[1]CitationFortinet Metamorfo Feb 2020CitationFireEye Metamorfo Apr 2018

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 20.0
Object version: 2.1
Created: May 26, 2020, 17:34 UTC (UTC+00:00)
Modified: Apr 11, 2024, 00:44 UTC (UTC+00:00)
Raw hash: 544ae66f95dc1ef9...

Imported snapshots across ATT&CK releases(3)

Release	Bundle imported	Object version	Modified	Status	Raw hash
20.0	Oct 18, 2026, 20:39 UTC (UTC+00:00)	2.1	Apr 11, 2024, 00:44 UTC (UTC+00:00)	Current bundle	`544ae66f95dc…`
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	2.1	Apr 11, 2024, 00:44 UTC (UTC+00:00)	Older bundle	`544ae66f95dc…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	2.1	Apr 11, 2024, 00:44 UTC (UTC+00:00)	Older bundle	`544ae66f95dc…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Medium Metamorfo Apr 2020
Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020.
Open source URL
[2]
ESET Casbaneiro Oct 2019
ESET Research. (2019, October 3). Casbaneiro: peculiarities of this banking Trojan that affects Brazil and Mexico. Retrieved September 23, 2021.
Open source URL
[3]
Casbaneiro
(Citation: ESET Casbaneiro Oct 2019)
[4]
Metamorfo
(Citation: Medium Metamorfo Apr 2020)(Citation: ESET Casbaneiro Oct 2019)
[5]
mitre-attackS0455
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use