Mispadu checks and will terminate execution if the compromised system’s language ID is not Spanish or Portuguese.
Mispadu
Mispadu is a Latin American banking trojan and stealer associated with financially motivated activity, including use by the Malteiro cluster and campaigns attributed by Proofpoint to TA2725.
Profile source: Mallory opens in a new tabMispadu
Family profile
Mispadu is a Latin American banking trojan and stealer associated with financially motivated activity, including use by the Malteiro cluster and campaigns attributed by Proofpoint to TA2725. It is one of at least 11 distinct LATAM banking trojan families identified by ESET and has been active alongside families such as Grandoreiro, Guildma, Mekotio/Casabaneiro, and others. Reporting states that TA2725 has used Brazilian banking malware including Mispadu to target organizations mainly in Brazil, Mexico, and Spain, and that a 2024 Mispadu Stealer variant targeted financial and cryptocurrency institutions in Mexico.
The malware is regionally targeted: it checks the compromised system language ID and terminates execution if the language is not Spanish or Portuguese. It has relied on user execution of malicious files to gain execution on victim machines, and related Malteiro activity used spearphishing emails with malicious ZIP attachments, VBS-based droppers, Base64-encoded scripts, and deobfuscation before execution.
Mispadu’s capabilities include monitoring browser activity for online banking actions and displaying full-screen overlay images to block access to the intended banking site or solicit additional data fields. It can steal credentials from Google Chrome, obtain credentials from mail clients via NirSoft MailPassView, list installed security products in the victim environment, capture and replace Bitcoin wallet data in the clipboard, and send collected financial data to its command-and-control server. Its binary has been reported as injected into memory via WriteProcessMemory, and it contains a copy of the OpenSSL library to encrypt C2 traffic.
High-confidence behaviors and context in the source material indicate a focus on banking fraud, credential theft, cryptocurrency theft via clipboard hijacking, and victim profiling in Spanish- and Portuguese-speaking environments, with observed targeting of financial institutions and cryptocurrency-related entities in Mexico.
Reported operators
Threat actors
2 named in public reportingTA2725 is a threat actor Proofpoint tracked since March 2022 that is known for using Brazilian banking malware (including Mispadu, Astaroth, and historically Grandoreiro) and credential phishing to target organizations mainly in Brazil, Mexico, and Spain.
MITRE ATT&CK
Mispadu in ATT&CK
42 distinct techniquesTechniques
42 techniques T1614.001 System Language Discovery T1547.001 Registry Run Keys / Startup Folder T1518.001 Security Software Discovery T1082 System Information Discovery T1547.009 Shortcut Modification T1083 File and Directory Discovery T1204.002 Malicious File T1115 Clipboard Data T1140 Deobfuscate/Decode Files or Information T1112 Modify Registry T1057 Process Discovery T1573 Encrypted Channel T1041 Exfiltration Over C2 Channel T1027 Obfuscated Files or Information T1555.003 Credentials from Web Browsers T1555.005 Password Managers T1555 Credentials from Password Stores T1204 User Execution T1055 Process Injection T1056.003 Web Portal Capture T1218.007 Msiexec T1573.002 Asymmetric Cryptography T1059.005 Visual Basic T1056 Input Capture T1217 Browser Information Discovery T1113 Screen Capture T1036 Masquerading T1176 Software Extensions T1055.001 Dynamic-link Library Injection T1657 Financial Theft T1566.001 Spearphishing Attachment T1566 Phishing T1106 Native API T1027.013 Encrypted/Encoded File T1056.001 Keylogging T1497.001 System Checks T1218.011 Rundll32 T1056.002 GUI Input Capture T1566.002 Spearphishing Link T1176.001 Browser Extensions T1534 Internal Spearphishing T1059 Command and Scripting Interpreter
Reporting
