Trojan.Grandoreiro.G
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 14,599 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 126 |
| First Seen: | July 15, 2023 |
| Last Seen: | July 16, 2026 |
| OS(es) Affected: | Windows |
Trojan.Grandoreiro.G is a heuristic detection that flags a Windows sample belonging to the Grandoreiro banking-trojan lineage, one of the most persistent Latin American e-banking threats tracked by the security industry. The detection name pairs the family label with a variant tag, and the sample analyzed here matches Grandoreiro cluster fingerprints with high confidence in automated similarity analysis.
Grandoreiro is a credential-stealing banking trojan built to hijack online-banking sessions, harvest financial logins and let a remote operator take manual control of an infected machine. Anyone whose endpoint alerts on Trojan.Grandoreiro.G should treat it as an active attempt to compromise banking and financial credentials and remediate the host promptly.
Table of Contents
What Is Trojan.Grandoreiro.G?
Trojan.Grandoreiro.G is the classification EnigmaSoft's engine assigns to a specific variant within the Grandoreiro family. Grandoreiro is a Delphi-authored banking trojan that has been active since at least 2016 and is widely documented on Malpedia, MITRE ATT&CK (Software ID S0531) and by numerous vendors. It historically targets online-banking customers in Brazil, Mexico, Spain, Portugal and other Spanish- and Portuguese-speaking markets, and has repeatedly expanded its geographic footprint and its list of targeted financial institutions.
The family operates on a malware-as-a-service model and is designed for financial fraud: it monitors for banking and payment portals, overlays fake windows or prompts, captures keystrokes, and gives operators backdoor control so they can navigate the victim's browser, simulate mouse and keyboard input and authorize fraudulent transactions in real time. In the analyzed sample, automated code-similarity scoring placed the specimen closest to other Grandoreiro variants (Grandoreiro.G at roughly 74% and Grandoreiro.F at roughly 71% similarity), with additional overlap against the related Brazilian families Banload and Ousaban and the generic Kryptik packer cluster. That neighborhood is highly consistent with the LATAM banking-trojan ecosystem to which Grandoreiro belongs.
How It Spreads / Distribution
Publicly documented Grandoreiro campaigns rely overwhelmingly on social engineering rather than exploits. The most common delivery method is malspam: phishing e-mails that impersonate tax authorities, courts, utility providers, government agencies and banks, urging the recipient to open an attachment or click a link to view an invoice, fine, tax notice or legal document. Victims are commonly funneled through a chain that begins with a small loader or script and pulls the much larger banking-trojan payload from an attacker-controlled host.
Reporting on the family also describes the use of ZIP archives, MSI installers and disguised executables, along with geofencing checks that confirm the victim is located in a targeted country before the final payload is delivered. Because Grandoreiro is distributed by multiple affiliates, the exact lure, packaging and hosting infrastructure rotate frequently. The general pattern to remember is user-initiated execution of a malicious file arriving through e-mail or a fraudulent download page.
Technical Analysis & Behavior
The analyzed specimen is a 32-bit (x86) Windows binary of roughly 5.05 MB (5,054,976 bytes). The large size is characteristic of Grandoreiro, whose Delphi payloads are frequently padded and bloated to frustrate analysis and scanning. The file carries a PE structure with two or more executable sections and imports VirtualQueryEx, a memory-inspection API often used to probe process memory layout. No commodity packer was identified by the static unpacker in this sample, though the code-similarity match to the Kryptik cluster indicates obfuscation techniques consistent with the family.
During dynamic analysis the sandbox recorded a behavior profile focused on evasion and stealthy execution rather than noisy disk activity. The observed behavior categories were: direct syscall use (invoking kernel services in a way that can bypass user-mode API hooks), process-manipulation evasion (tampering with process context to hide activity or defeat monitoring), process/shell execution (spawning child processes or shell commands), and anti-debugging (checking for and resisting analysis environments). These map cleanly onto MITRE ATT&CK tactics for Defense Evasion, Execution and Privilege Escalation that are associated with Grandoreiro, and they reflect the family's well-documented emphasis on evading detection and emulation.
Notably, in this particular run the sandbox logged zero persistent registry modifications and zero files written to disk. That is common for samples that detect analysis, gate their real behavior behind geofencing or anti-debug checks, or defer their fraud logic until a targeted banking site is opened. The absence of on-disk changes in one automated run should not be read as the malware being harmless; it reflects the conditions of that single execution.
Indicators of Compromise
The following indicators identify the specific representative sample analyzed for this report. These values reflect one analyzed sample; specific indicators rotate frequently across Grandoreiro builds, so hashes and file sizes will differ between campaigns and affiliates.
- SHA-256: e8f338ba826a3b30857ff9355c03eaa34c40a250d43c735de04e1fb9681f3a7c
- SHA-1: b927807c89954f79665e2525544347a1ef3c3b25
- MD5: 2255bf734c79fe7f99c5f5adc018bd15
- File size: 5,054,976 bytes (~4.82 MB)
- Architecture / type: 32-bit (x86) Windows PE with two or more executable sections
- Digital signature: none valid — the sample is unsigned, so it carries no legitimate publisher identity
The sample imported VirtualQueryEx and exhibited DLL-related traits within its PE. No network IOCs (C2 addresses, domains or URLs), first-seen date or distribution statistics are asserted here, because they were not part of the verified sandbox record for this sample.
Detection Heuristics
Anti-malware engines flag Trojan.Grandoreiro.G through a combination of family code-similarity matching and behavioral heuristics rather than a single static string. In this case the specimen scored highest against known Grandoreiro variants, which is the primary basis for the family attribution. Additional heuristic signals that raise an engine's confidence include the unusually large Delphi payload, an unsigned PE with multiple executable sections, imports geared toward memory inspection (VirtualQueryEx), and runtime behaviors such as direct syscall invocation, anti-debugging checks and process-manipulation evasion. Any one of these can be benign in isolation; together, in a large unsigned executable that resembles a known banking-trojan cluster, they form a high-confidence detection. Because Grandoreiro authors continuously re-obfuscate and repack, behavior-based and similarity-based detection tends to age better than hash-only signatures.
Digital Forensics
Investigators triaging a suspected Grandoreiro infection should hunt beyond the single automated run. Start with the file-level indicators above, then look for large (multi-megabyte) unsigned Delphi executables in user-writable locations such as the user profile, %APPDATA%, %TEMP% and %PROGRAMDATA%. Although this sandbox run recorded zero registry modifications and zero file writes, Grandoreiro on real victim machines commonly establishes persistence through Run keys, scheduled tasks or startup entries and drops staging files, so those areas still warrant manual inspection.
On the process side, watch for unexpected child processes and shell executions spawned by the sample (consistent with the observed process/shell-execute behavior), and for processes exhibiting anti-analysis or memory-probing activity. Endpoint and EDR telemetry should be reviewed for direct syscall usage and process-context tampering. Correlate mail-gateway logs for the phishing lure, proxy/DNS logs for the payload-download stage, and browser session anomalies coinciding with banking-site visits. Because indicators rotate, prioritize behavior and family-similarity signals over any single static artifact.
Symptoms of Infection
- Anti-malware alerts naming Trojan.Grandoreiro.G or a related Grandoreiro/Banload/Ousaban variant.
- Unexpected pop-ups, overlay windows or fake prompts appearing during online-banking sessions.
- Banking portals asking for extra credentials, tokens or verification codes at unusual moments.
- The mouse pointer or browser navigating on its own, or transactions the user did not initiate.
- System sluggishness, unfamiliar large executables in user folders, or new startup/scheduled-task entries.
- Security tools being disabled or behaving abnormally, consistent with the sample's evasion behaviors.
How to Remove Trojan.Grandoreiro.G
Because Grandoreiro is built to steal banking credentials and grant remote control, treat any confirmed detection as an active compromise. Disconnect the affected machine from the network and, from a known-clean device, change online-banking, e-mail and other sensitive passwords and contact your bank about recent activity.
- Run a full SpyHunter scan. Install and update SpyHunter, then run a complete system scan to detect and remove Trojan.Grandoreiro.G and any associated loaders, persistence entries or dropped components. Allow the scan to finish and apply all recommended removals, then reboot and rescan to confirm the system is clean.
- Boot into Safe Mode with Networking if the malware resists removal or interferes with your security software, then repeat the full scan. Safe Mode limits the trojan's ability to run its evasion and process-manipulation routines.
- Reset affected browsers to clear malicious extensions, cached credentials and hijacked settings:
- Google Chrome: Settings → Reset settings → "Restore settings to their original defaults," and review Settings → Extensions, removing anything unfamiliar.
- Mozilla Firefox: Help → More troubleshooting information → "Refresh Firefox," and remove unknown add-ons under Add-ons and themes.
- Microsoft Edge: Settings → Reset settings → "Restore settings to their default values," and check Extensions for unwanted items.
- Android (for related mobile campaigns): boot into Safe mode, uninstall any recently added or unknown app, revoke Accessibility and Device-admin permissions granted to suspicious apps, and run a reputable mobile security scan.
- Manual cleanup for advanced users. After the automated scan, inspect Run keys, Scheduled Tasks and startup folders for entries launching large unsigned executables from user-writable paths, and remove confirmed malicious files. Given the family's evasion capabilities, verify remediation with a second full scan rather than trusting a single pass.
For high-value or credential-sensitive machines, consider rebuilding from a known-good image after backing up data, since banking trojans may have exposed stored secrets during the infection window.
Conclusion
Trojan.Grandoreiro.G represents a variant of the long-running Grandoreiro banking trojan, a Delphi-based LATAM financial threat engineered for credential theft, browser hijacking and remote fraud. The analyzed sample — a ~4.82 MB unsigned 32-bit executable exhibiting direct syscall use, anti-debugging, process-manipulation evasion and shell execution — fits the family's profile and clusters most closely with other Grandoreiro variants in automated similarity analysis. Because the family rotates its hashes, packaging and infrastructure constantly, the safest response is prompt, behavior-aware removal followed by credential resets. Running a full SpyHunter scan, cleaning affected browsers and verifying with a second pass will remove the threat and help restore the integrity of the affected system.
Analysis Report
General information
| Family Name: | Trojan.Grandoreiro.G |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
2255bf734c79fe7f99c5f5adc018bd15
SHA1:
b927807c89954f79665e2525544347a1ef3c3b25
SHA256:
E8F338BA826A3B30857FF9355C03EAA34C40A250D43C735DE04E1FB9681F3A7C
File Size:
5.05 MB, 5054976 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have security information
- File has exports table
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
Show More
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Traits
- 2+ executable sections
- dll
- VirtualQueryEx
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 12,924 |
|---|---|
| Potentially Malicious Blocks: | 127 |
| Whitelisted Blocks: | 12,783 |
| Unknown Blocks: | 14 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Banload.XB
- Grandoreiro.F
- Grandoreiro.G
- Kryptik.YRF
- Ousaban.D
Show More
- Ousaban.Z
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Anti Debug |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\b927807c89954f79665e2525544347a1ef3c3b25_0005054976.,LiQMAxHB
|
