Loading malware…
Mispadu is a Latin American banking trojan targeting Windows systems, historically focused on Spanish- and Portuguese-speaking users and in recent years particularly associated with campaigns against victims in Mexico. It is part of the broader LATAM banking trojan ecosystem alongside families such as Casbaneiro, Grandoreiro, Guildma, Mekotio, Amavaldo, and Ousaban, which share overlapping tradecraft, custom string encryption and obfuscation approaches, and similar distribution patterns.
Mispadu is commonly delivered through spam campaigns that use invoice-themed social engineering and rely on user execution of downloaded archives and installer components. Observed infection chains have used ZIP archives containing MSI installers and heavily obfuscated scripts, culminating in an AutoIt-based loader or injector that launches a Delphi payload in memory. The malware has also been associated with malicious advertising activity used to distribute related LATAM banking malware.
Once active, Mispadu performs targeting and anti-analysis checks. It verifies system language settings and terminates unless the host is configured for Spanish or Portuguese locales, and observed variants have also checked for virtualized environments before continuing. On infected hosts, Mispadu steals credentials from web browsers including Google Chrome and has used NirSoft utilities to recover credentials from mail clients. It can enumerate installed security products, monitor browser activity related to online banking, and present banking-themed overlay windows to facilitate theft of financial information. Reported variants also capture clipboard data and can replace copied cryptocurrency wallet information, enabling theft of digital assets in addition to banking fraud.
The malware communicates with command-and-control infrastructure using encrypted traffic and exfiltrates collected financial and credential data to operator-controlled servers. Mispadu has been described both as a banking trojan and, in some campaigns, as a stealer targeting financial and cryptocurrency institutions. Its operations fit the largely manual fraud model common to Latin American banking malware, where successful theft depends on victim interaction and operator-driven follow-on actions rather than fully automated monetization.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Mispadu checks and will terminate execution if the compromised system’s language ID is not Spanish or Portuguese.
TA2725 is a threat actor Proofpoint tracked since March 2022 that is known for using Brazilian banking malware (including Mispadu, Astaroth, and historically Grandoreiro) and credential phishing to target organizations mainly in Brazil, Mexico, and Spain.
40 distinct techniques documented for this family, organized by ATT&CK tactic.
This campaign uses phishing emails with financial themes, directing users to a compromised website where the payload is hosted...
For this particular case, Mispadu’s entry vector is spam, similar to past campaigns involving the malware. By sending messages that refer to overdue invoices, attackers create a seemingly urgent situation that then persuades receivers to download a .zip file from malicious URLs.
T1047 Windows Management Instrumentation ✅ ❌ ❌ ✅ ❌ ❌ ✅ ✅ ✅ ❌ ❌ ❌
T1059.001 Command and Scripting Interpreter: PowerShell ✅ ✅ ❌ ❌ ❌ ❌ ✅ ✅ ❌ ✅ ✅ ❌
T1059.003 Command and Scripting Interpreter: Windows Command Shell ❌ ✅ ✅ ❌ ✅ ❌ ✅ ✅ ❌ ✅ ✅ ❌
This zip file contains an MSI (Microsoft Installer file) that has a VBScript... reveal the final VBScript file that executes an AutoIT Loader/Injector.
T1059.007 Command and Scripting Interpreter: JavaScript/JScript ✅ ✅ ❌ ✅ ❌ ❌ ✅ ✅ ❌ ✅ ✅ ✅
The final VBScript also loads the AutoIT file, which loads into the memory the final payload: a Delphi file containing the trojan code and processes.
This zip file contains an MSI (Microsoft Installer file) that has a VBScript. This is followed by three layers of obfuscation that, when deobfuscated, reveal the final VBScript file that executes an AutoIT Loader/Injector.
T1036.005 Masquerading: Match Legitimate Name or Location ❌ ✅ ✅ ✅ ❌ ❌ ❌ ✅ ❌ ❌ ❌ ✅
reveal the final VBScript file that executes an AutoIT Loader/Injector... loads into the memory the final payload: a Delphi file containing the trojan code and processes.
they all obfuscate either payloads or configuration data in some way
Operators need to react to this situation and manually command the malware to display the fake pop-up window and take control of the victim’s machine
to steal credentials, they tend to use either fake pop-up windows or keyloggers
to steal credentials, they tend to use either fake pop-up windows or keyloggers
The Delphi binary executes a browser banking overlay that steals the victim’s data and uses the name and logo of legitimate banks.
T1552.001 Unsecured Credentials: Credentials In Files ❌ ✅ ✅ ✅ ❌ ❌ ❌ ✅ ❌ ❌ ❌ ❌
The binary also has two legitimate tools, NirSoft’s WebBrowserPassView and Mail PassView, which can collect user’s data.
Agent Tesla can gather credentials from a number of browsers... APT3 has used tools to dump passwords from browsers... APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge
periodically scanning active windows based on name or title
The final VBScript also retrieves data on the operating system version.
T1083 File and Directory Discovery ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ❌ ❌ ❌
If the script detects a virtual environment such as the following, the script terminates its execution: Hyper-V VirtualBox VMWare
Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.
It also inspects whether the system is using any of the following languages... As aforementioned, the attackers are targeting users whose machines are set to use these identified languages. If the system is using a different language ID from those listed, the attack process stops.
Operators need to react to this situation and manually command the malware to display the fake pop-up window and take control of the victim’s machine
to steal credentials, they tend to use either fake pop-up windows or keyloggers
to steal credentials, they tend to use either fake pop-up windows or keyloggers
The Mispadu payload contained a hardcoded C2 address which used HTTPS as communication protocol.
We believe these to be the command and control servers used by the malware... POST PUT Content-Disposition: form-data... Mozilla/5.0 ... HTTP/1.1 200 OK
154 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
55 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Banking trojan/stealer targeting financial and cryptocurrency institutions in Mexico.
Banking trojan targeting Latin America (notably Mexico and Brazil) delivered via phishing with HTA attachments (sometimes via password-protected PDFs); uses an AutoIT loader and dynamically generated delivery artifacts to frustrate EDR; includes self-propagation via email and expanded targeting to banks outside LATAM and crypto exchanges.
Banking trojan targeting Latin America (and expanding beyond) delivered via phishing with HTA attachments; uses an AutoIT loader and legitimate files; can self-propagate via email and targets online banking sites and cryptocurrency exchanges.
Brazilian banking malware used by TA2725 in campaigns targeting organizations mainly in Brazil, Mexico, and Spain.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.