S0531: Grandoreiro
Grandoreiro is a banking trojan written in Delphi that was first observed in 2016 and uses a Malware-as-a-Service (MaaS) business model. Grandoreiro has confirmed victims in Brazil, Mexico, Portugal, and Spain.[1][2]
Security context for executives and security teams
S0531: Grandoreiro describes [Grandoreiro](https://attack.mitre.org/software/S0531) is a banking trojan written in Delphi that was first observed in 2016 and uses a Malware-as-a-Service (MaaS) business model. [Grandoreiro](https://attack.mitre.org/software/S0531) has confirmed victims in Brazil, Mexico, Portugal, and Spain.(Citation: Securelist Brazilian Banking Malware July 2020)(Citation: ESET Grandoreiro April 2020)
Executive priority
S0531: Grandoreiro is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate S0531: Grandoreiro by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
- Network, endpoint, and security-tool telemetry
Detection direction
- Validate whether S0531: Grandoreiro appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Grandoreiro
Grandoreiro is a banking trojan written in Delphi that was first observed in 2016 and uses a Malware-as-a-Service (MaaS) business model. Grandoreiro has confirmed victims in Brazil, Mexico, Portugal, and Spain.[1][2]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1059.005 | Visual BasicSub-technique | Grandoreiro can use VBScript to execute malicious code.[1][2] |
| Enterprise | T1204.001 | Malicious LinkSub-technique | Grandoreiro has used malicious links to gain execution on victim machines.CitationIBM Grandoreiro April 2020[2] |
| Enterprise | T1057 | Process Discovery | Grandoreiro can identify installed security tools based on process names.[2] |
| Enterprise | T1547.009 | Shortcut ModificationSub-technique | Grandoreiro can write or modify browser shortcuts to enable launching of malicious browser extensions.CitationIBM Grandoreiro April 2020 |
| Enterprise | T1539 | Steal Web Session Cookie | Grandoreiro can steal the victim's cookies to use for duplicating the active session from another device.CitationIBM Grandoreiro April 2020 |
| Enterprise | T1105 | Ingress Tool Transfer | Grandoreiro can download its second stage from a hardcoded URL within the loader's code.CitationIBM Grandoreiro April 2020[2] |
| Enterprise | T1573.002 | Asymmetric CryptographySub-technique | Grandoreiro can use SSL in C2 communication.CitationIBM Grandoreiro April 2020 |
| Enterprise | T1102.001 | Dead Drop ResolverSub-technique | Grandoreiro can obtain C2 information from Google Docs.[1] |
| Enterprise | T1036.005 | Match Legitimate Resource Name or LocationSub-technique | Grandoreiro has named malicious browser extensions and update files to appear legitimate.CitationIBM Grandoreiro April 2020[2] |
| Enterprise | T1112 | Modify Registry | Grandoreiro can modify the Registry to store its configuration at `HKCU\Software\` under frequently changing names including |
| Enterprise | T1102.002 | Bidirectional CommunicationSub-technique | Grandoreiro can utilize web services including Google sites to send and receive C2 data.CitationIBM Grandoreiro April 2020[2] |
| Enterprise | T1041 | Exfiltration Over C2 Channel | Grandoreiro can send data it retrieves to the C2 server.[2] |
| Enterprise | T1222.001 | Windows PermissionsSub-technique | Grandoreiro can modify the binary ACL to prevent security tools from running.[2] |
| Enterprise | T1027.013 | Encrypted/Encoded FileSub-technique | The Grandoreiro payload has been delivered encrypted with a custom XOR-based algorithm and also as a base64-encoded ZIP file.[1][2][2] |
| Enterprise | T1124 | System Time Discovery | Grandoreiro can determine the time on the victim machine via IPinfo.[2] |
| Enterprise | T1547.001 | Registry Run Keys / Startup FolderSub-technique | Grandoreiro can use run keys and create link files in the startup folder for persistence.CitationIBM Grandoreiro April 2020[2] |
| Enterprise | T1204.002 | Malicious FileSub-technique | Grandoreiro has infected victims via malicious attachments.CitationIBM Grandoreiro April 2020 |
| Enterprise | T1033 | System Owner/User Discovery | Grandoreiro can collect the username from the victim's machine.[2] |
| Enterprise | T1010 | Application Window Discovery | Grandoreiro can identify installed security tools based on window names.[2] |
| Enterprise | T1027.011 | Fileless StorageSub-technique | Grandoreiro can store its configuration in the Registry at `HKCU\Software\` under frequently changing names including |
| Enterprise | T1082 | System Information Discovery | Grandoreiro can collect the computer name and OS version from a compromised host.[2] |
| Enterprise | T1027.001 | Binary PaddingSub-technique | Grandoreiro has added BMP images to the resources section of its Portable Executable (PE) file increasing each binary to at least 300MB in size.[2] |
| Enterprise | T1218.007 | MsiexecSub-technique | Grandoreiro can use MSI files to execute DLLs.[1] |
| Enterprise | T1518.001 | Security Software DiscoverySub-technique | Grandoreiro can list installed security products including the Trusteer and Diebold Warsaw GAS Tecnologia online banking protections.[2][2] |
| Enterprise | T1185 | Browser Session Hijacking | Grandoreiro can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.[1]CitationIBM Grandoreiro April 2020[2] |
| Enterprise | T1056.001 | KeyloggingSub-technique | Grandoreiro can log keystrokes on the victim's machine.[2] |
| Enterprise | T1070.004 | File DeletionSub-technique | Grandoreiro can delete .LNK files created in the Startup folder.[2] |
| Enterprise | T1497.001 | System ChecksSub-technique | Grandoreiro can detect VMWare via its I/O port and Virtual PC via the |
| Enterprise | T1685 | Disable or Modify Tools | Grandoreiro can hook APIs, kill processes, break file system paths, and change ACLs to prevent security tools from running.[2] |
| Enterprise | T1115 | Clipboard Data | Grandoreiro can capture clipboard data from a compromised host.CitationIBM Grandoreiro April 2020 |
| Enterprise | T1176.001 | Browser ExtensionsSub-technique | Grandoreiro can use malicious browser extensions to steal cookies and other user information.CitationIBM Grandoreiro April 2020 |
| Enterprise | T1140 | Deobfuscate/Decode Files or Information | Grandoreiro can decrypt its encrypted internal strings.[2] |
| Enterprise | T1189 | Drive-by Compromise | Grandoreiro has used compromised websites and Google Ads to bait victims into downloading its installer.[1]CitationIBM Grandoreiro April 2020 |
| Enterprise | T1686.002 | Network Device FirewallSub-technique | Grandoreiro can block the Deibold Warsaw GAS Tecnologia security tool at the firewall level. [2] |
| Enterprise | T1548.002 | Bypass User Account ControlSub-technique | Grandoreiro can bypass UAC by registering as the default handler for .MSC files.[2] |
| Enterprise | T1016 | System Network Configuration Discovery | Grandoreiro can determine the IP and physical location of the compromised host via IPinfo.[2] |
| Enterprise | T1106 | Native API | Grandoreiro can execute through the |
| Enterprise | T1568.002 | Domain Generation AlgorithmsSub-technique | Grandoreiro can use a DGA for hiding C2 addresses, including use of an algorithm with a user-specific key that changes daily.[1][2] |
| Enterprise | T1071.001 | Web ProtocolsSub-technique | Grandoreiro has the ability to use HTTP in C2 communications.CitationIBM Grandoreiro April 2020[2] |
| Enterprise | T1566.002 | Spearphishing LinkSub-technique | Grandoreiro has been spread via malicious links embedded in e-mails.CitationIBM Grandoreiro April 2020[2] |
| Enterprise | T1555.003 | Credentials from Web BrowsersSub-technique | Grandoreiro can steal cookie data and credentials from Google Chrome.CitationIBM Grandoreiro April 2020[2] |
| Enterprise | T1686 | Disable or Modify System Firewall | Grandoreiro can block the Deibold Warsaw GAS Tecnologia security tool at the firewall level.[2] |
| Enterprise | T1087.003 | Email AccountSub-technique | Grandoreiro can parse Outlook .pst files to extract e-mail addresses.[2] |
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(2)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.2 | 1.2 | Current bundle | a50e89f57a9d… | ||
| 19.1 | 1.2 | Older bundle | a50e89f57a9d… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Securelist Brazilian Banking Malware July 2020
GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.
Open source URL - [2]ESET Grandoreiro April 2020
ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020.
Open source URL - [3]mitre-attackS0531Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.