Metamorfo
MITRE ATT&CK: S0455 View on attack.mitre.org
Aliases: Casbaneiro, Metamorfo
- First seen
- 2018-04-01 00:00:00
- Malware type
- trojan
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 63 (51 malicious)
- Last IoC activity
- 2026-10-16 14:04:50
- Profile updated
- 2026-07-07 14:04:42
Targeted industries: financial-services
Targeted regions: country_code:br country_code:mx
Context
Metamorfo is a Latin-American banking trojan operated by a Brazilian cybercrime group that has been active since at least April 2018. The group focuses on targeting banks and cryptocurrency services in Brazil and Mexico.
Recent IoC activity
51 malicious indicators in Maltiverse are attributed to Metamorfo (S0455). The 20 most recently updated:
Detection coverage
- 1 YARA rules
- 815 Sigma rules
Malware & tools used
- JavaScript (attack-pattern)
- Software Discovery (attack-pattern)
- Keylogging (attack-pattern)
- Security Software Discovery (attack-pattern)
- Asymmetric Cryptography (attack-pattern)
- Web Protocols (attack-pattern)
- Msiexec (attack-pattern)
- Malicious File (attack-pattern)
- Dynamic-link Library Injection (attack-pattern)
- Dead Drop Resolver (attack-pattern)
- Encrypted/Encoded File (attack-pattern)
- Native API (attack-pattern)
- DLL (attack-pattern)
- Spearphishing Attachment (attack-pattern)
- System Time Discovery (attack-pattern)
- Non-Application Layer Protocol (attack-pattern)
- Registry Run Keys / Startup Folder (attack-pattern)
- Exfiltration Over C2 Channel (attack-pattern)
- Indicator Removal (attack-pattern)
- GUI Input Capture (attack-pattern)
- Virtualization/Sandbox Evasion (attack-pattern)
- File Deletion (attack-pattern)
- Modify Registry (attack-pattern)
- One-Way Communication (attack-pattern)
- Automated Collection (attack-pattern)
Detection rules
- ARKBIRD_SOLG_Malware_Casbaneiro_MSI (yara-rule)
Reports & references
- advintel.io — Economic Growth Digital Inclusion Specialized Crime Financial Cyber Fraud In Latam (report)
- botconf.eu — B2019 Soucek Hornak Demystifyingbankingtrojansfromlatinamerica (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Metamorfo (report)
- Cisco Talos — Metamorfo Brazilian Campaigns (report)
- twitter.com — 1418706916922986504 (report)
- github.com — Metamorfo.Md (report)
- Mandiant — Metamorfo Campaign Targeting Brazilian Users (report)
- cofense.com — Autohotkey Banking Trojan (report)
- medium.com — The Avast Abuser Metamorfo Banking Malware Hides By Abusing Avast Executable Ac9B8B392767 (report)
- ESET — Casbaneiro Trojan Dangerou (report)
- bitdefender.com — Bitdefender Pr Whitepaper Metamorfo Creat4500 En En Genericuse (report)
- blog.ensilo.com — Metamorfo Avast Abuser (report)
- MITRE ATT&CK — S0455 (report)
- ESET — Casbaneiro Trojan Dangerous Cooking (report)
- umbrella.cisco.com — Navigating Cybersecurity During A Pandemic Latest Malware And Threat Actors (report)