S0455 - Metamorfo

Metamorfo is a Latin-American banking trojan operated by a Brazilian cybercrime group that has been active since at least April 2018. The group focuses on targeting banks and cryptocurrency services in Brazil and Mexico.

Author
agomez
Created
2023-08-14 15:57:26
Last updated
2026-02-07 19:01:16
Downloads
339161
URL indicators
2
Sample indicators
31

Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.

Latest Indicators of Compromise in this feed

39aea1d9a4539f3280b122cdbf70bf52e0549b74a5b936a72d442d7adfd65156 Sample

modified 2026-10-16 14:04:50
Casbaneiro (Cyber Threat Alliance)

2f787f5706205bab7063741acfa68015178b90c8d06a1839cba33b90a419d6cb Sample

modified 2026-10-13 16:44:35
Casbaneiro (Cyber Threat Alliance)

215720°.msi Sample

modified 2026-10-12 02:31:19
Metamorfo (MalwareBazaar Abuse.ch)

BoIetos_Novembro.lnk Sample

modified 2026-10-12 01:30:25
Metamorfo (Abuse.ch)

z90BOLET0_120923_1_.msi Sample

modified 2026-10-11 06:41:27
Metamorfo (MalwareBazaar Abuse.ch)

dd157aa5626e71ed1c5b6ddee211ac4edc0ecbcab5016a78ab8a6a0f07f4db27 Sample

modified 2026-10-06 10:45:27
Casbaneiro (Cyber Threat Alliance)

f5c0a71b972a63ce6a5e503a0902c8481f788a580a5cbf2246ee4a163bcd44b2.msi Sample

modified 2026-09-28 00:46:11
Metamorfo (MalwareBazaar Abuse.ch) · Generic Malware (Hybrid-Analysis)

Curriculo.lnk Sample

modified 2026-09-11 02:25:33
Metamorfo (Abuse.ch)

BoIetos - 17-11.lnk Sample

modified 2026-09-11 02:25:33
Metamorfo (Abuse.ch)

Foto.lnk Sample

modified 2026-09-11 02:25:33
Metamorfo (Abuse.ch)

18 de Novembro.lnk Sample

modified 2026-09-11 02:25:23
Metamorfo (Abuse.ch)

18 de Novembro.lnk Sample

modified 2026-09-11 02:25:23
Metamorfo (Abuse.ch)

18 de Novembro.lnk Sample

modified 2026-09-11 02:25:23
Metamorfo (Abuse.ch)

Curriculo.lnk Sample

modified 2026-09-11 02:25:22
Metamorfo (Abuse.ch)

e8ec6f2b265691c45d18a44c.msi Sample

modified 2026-09-07 18:01:36
Generic.Malware (MalwareBazaar Abuse.ch) · Metamorfo (MalwareBazaar Abuse.ch)

0bf0eb3822fb47e07d7beabb6f5f8e8d5c76b94ca70bfe379fe0a8b092c8517f Sample

modified 2026-08-11 08:45:04
Generic.Malware (MalwareBazaar Abuse.ch) · Metamorfo (ThreatFox Abuse.ch) · Generic Malware (Hybrid-Analysis)

BOLET0_120923__1_.msi Sample

modified 2026-08-03 00:17:48
Metamorfo (MalwareBazaar Abuse.ch)

foto.lnk Sample

modified 2026-07-28 00:47:20
Generic.Malware (Abuse.ch) · Metamorfo (Abuse.ch)

a4b5950b7ec48255a991f1dc1d2da432.msi Sample

modified 2026-07-23 07:39:10
Generic.Malware (Abuse.ch) · Metamorfo (Abuse.ch)

Anexo - 05116510.lnk Sample

modified 2026-06-29 01:44:35
Metamorfo (Abuse.ch)

BoIetos da Semana.lnk Sample

modified 2026-06-27 13:49:43
Metamorfo (Abuse.ch)

Curriculum.lnk Sample

modified 2026-06-20 17:38:45
Metamorfo (Abuse.ch)

4ec1c47ada2fd1efe8fd1b3608d6fa4b.msi Sample

modified 2026-06-17 03:50:19
Metamorfo (MalwareBazaar Abuse.ch)

http://modulowinapp.com/TeamViewer.zip URL

modified 2026-04-30 18:09:54
Metamorfo (Maltiverse Threat Observatory) · Trojan.generic (Maltiverse Threat Observatory)

IM-87678A-1A.msi Sample

modified 2026-04-26 05:35:21
Metamorfo (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

BoIetos - 16-11.lnk Sample

modified 2026-04-20 11:06:42
Metamorfo (Abuse.ch)

f41ac6d123e69a06b591a88c0ee7f1fe.msi Sample

modified 2026-03-20 05:17:09
Metamorfo (MalwareBazaar Abuse.ch)

Rastreio SEDEX.zip Sample

modified 2026-01-20 00:24:24
Metamorfo (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

926379547581c21c9a65f6f7f624e301.msi Sample

modified 2026-01-20 00:22:26
Metamorfo (MalwareBazaar Abuse.ch)

m.zip Sample

modified 2026-01-04 05:50:16
Metamorfo (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

IM-vL5WWvBl.msi Sample

modified 2025-12-06 00:16:18
Metamorfo (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

poad2_4QJ_Sl__(31).cmd Sample

modified 2025-11-25 19:20:51
Metamorfo (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

https://live-mail-acesso.lpages.co/doc1/ URL

modified 2025-11-20 01:44:06
Metamorfo (Maltiverse Research Team)

Aplicativo Seguro.msi Sample

modified 2025-10-01 06:47:55
Metamorfo (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

cd5dbada75f47ea26cf666871c03c0b5.msi Sample

modified 2025-09-29 01:40:19
Metamorfo (MalwareBazaar Abuse.ch)

f3cb865ab096f2797e74e648eebb8c35.msi Sample

modified 2025-08-25 00:00:19
Metamorfo (MalwareBazaar Abuse.ch)

b18a4f50422c221450f31e408ece3cd2.msi Sample

modified 2025-06-15 00:06:43
Metamorfo (MalwareBazaar Abuse.ch)

http://185.101.93.72/14840646743032CDBOX/14840646743032CDBOX.php URL

modified 2025-03-21 07:47:41
Metamorfo (ThreatFox Abuse.ch)

0241a17a20b2cdc613afedfd6f26f952d79613944f0b7435ea2c87a4ad0f9bf8 Sample

modified 2025-02-21 21:45:54
Metamorfo (MalwareBazaar Abuse.ch)

BL.373769.msi Sample

modified 2025-02-17 21:24:00
Metamorfo (MalwareBazaar Abuse.ch)

Anexo - 18102145782.lnk Sample

modified 2025-02-17 20:03:18
Metamorfo (Abuse.ch)

Foto.lnk Sample

modified 2025-02-16 00:13:52
Metamorfo (Abuse.ch)

Outubro.lnk Sample

modified 2025-02-14 11:21:09
Metamorfo (Abuse.ch)

efaef34ef28217ed3b4d1066bc2c96354bba13d5399d9779ec58801fa72b7a99.msi Sample

modified 2024-09-21 15:05:36
Metamorfo (MalwareBazaar Abuse.ch) · Generic Malware (Hybrid-Analysis)

z13BOLET0_120923(1).msi Sample

modified 2024-09-20 18:09:28
Metamorfo (MalwareBazaar Abuse.ch)

z32BOLET0120923(1).msi Sample

modified 2024-09-20 18:09:22
Metamorfo (MalwareBazaar Abuse.ch)

http://3.145.213.63/contador/serv.php URL

modified 2024-09-08 11:21:33
Metamorfo (ThreatFox Abuse.ch)

NotaFiscal_6476297e020db.msi Sample

modified 2023-11-23 00:45:18
Metamorfo (MalwareBazaar Abuse.ch) · Generic Malware (Hybrid-Analysis)

fnfactura.cfd Hostname

modified 2023-08-30 09:18:02
Metamorfo (ThreatFox Abuse.ch)

6Nota-Fiscal_1685465470.zip Sample

modified 2023-05-30 19:18:47
Metamorfo (MalwareBazaar Abuse.ch)

Visualizar_Nota_Fiscal.msi Sample

modified 2023-05-20 09:22:41
Backdoor (VM-Ray) · Metamorfo (MalwareBazaar Abuse.ch)