Casbaneiro Malware Hides C2 Activity Until Victims Visit Banking Websites

Casbaneiro malware is hiding its main command and control traffic until an infected user visits a targeted banking website.

The Windows banking trojan combines phishing messages, location checks, staged downloads, and separate data collection servers to make an active infection appear quiet during routine analysis.

The campaign targets users across Latin America, with activity linked to Argentina, Peru, Colombia, and Mexico. Its key trick is timing: stolen information can leave the computer before the main control channel opens.

A lack of immediate C2 traffic therefore does not mean the malware is inactive. Researchers from Fortinet’s FortiGuard Labs identified the campaign in August 2026.

In a technical report published on September 10, researcher Rachael Liao described how Casbaneiro separates email theft, victim registration, and remote control across different servers. The design makes individual connections harder to connect into one clear attack chain.

Casbaneiro Malware Hides C2 Activity

The infection starts with emails and PDF files posing as invoices or legal notices, including claims about court proceedings. These messages create pressure to act quickly.

Some include the recipient’s email address, giving the lure a personal touch that can make a malicious link seem more trustworthy.

That link leads to a webpage that checks the visitor’s IP address. Users outside the selected country are sent to legitimate websites such as Google or YouTube.

This resembles Grandoreiro’s regional filtering tactics, where location checks help banking malware limit delivery and avoid exposing its payload to outside researchers.

Visitors inside the target region receive a page containing a ZIP archive encoded with Base64 inside JavaScript. The script starts the download through the browser’s normal download interface, then redirects to a blank page. This sequence gives the victim fewer visible reasons to question what has just happened.

The archive contains an HTA file, a Windows application format that can run scripts. It loads external JavaScript, which retrieves an XML script package containing JScript.

That code uses Windows Management Instrumentation to check for sandbox environments and confirm that the operating system language matches an approved list.

After those checks, the downloader retrieves three separate components: a legitimate AutoIt interpreter, a compiled AutoIt script, and a compressed payload.

AutoIt Loader Builds the Infection

Random filenames make tracking harder. Splitting the components also weakens file analysis because their combined behavior may not be clear when each file is examined on its own.

A Startup folder shortcut runs the AutoIt script again when the user signs in. The loader shows a fake Windows service window before unpacking the payload and injecting it into RegSvcs.exe, or mobsync.exe if RegSvcs.exe is missing. Related Horabot banking trojan activity also used AutoIt components and Startup shortcuts.

Casbaneiro decrypts stored settings using the same algorithm as Ousaban. It joins fragments of encrypted strings and keys only when needed.

It also rejects systems using German, French, or English as their default language. The shared algorithm does not, by itself, establish that both campaigns have the same operator.

The trojan collects address book contacts and sender and recipient details from Microsoft Outlook messages. It sends that information without encryption.

It also builds a victim identifier by hashing the computer name, username, and executable name with MD5, then uses local markers to avoid repeating some collection tasks. Another server receives Base64 encoded victim information and returns HTTP 403 Forbidden.

Casbaneiro treats this response as the expected outcome, retrying when it receives any other status. Analysts who read the error as evidence of dead infrastructure could miss a working part of the attack rather than a failed connection.

Only a visit to a targeted bank website triggers the main C2 exchange. The available commands include keyboard control, clipboard pasting, file execution, command execution, and fake banking windows.

Similar Ousaban banking session attacks show why tests that never open a targeted bank page may miss important malware behavior.

Fortinet also found HTTP requests without a Host header, unusually large Content-Length values, and bodies sent through many small packets.

These irregularities may complicate traffic inspection. Defenders should connect email, endpoint, and network events, monitor unexpected AutoIt execution and Startup shortcuts, and avoid treating HTTP 403 responses as proof that a suspicious server is harmless.

Organizations should also strengthen email filtering, keep antivirus protection current, and train staff to question unexpected invoice or legal messages. Fortinet says its antivirus service detects the campaign’s phishing PDFs, malicious JavaScript, and Casbaneiro payload.

For investigations, the published indicators below provide sample hashes, network addresses, and cryptocurrency addresses from the original report, alongside local artifacts that can help teams check whether suspicious activity matches this infection chain.

Indicators of compromise (IoCs):-

File Hashes

Sample type	Hash as published
PDF	6bb4372d0d02ec87b76409f69d445a93910964f8db457bafafb97a011da59e73
PDF	40d253480f752805e58c21266e40afe99afc96feea0d355732af5bea459db1dd
PDF	bf92a287a3d79afb73a3f2d38877ec37c22a9f4a7d6ac2e0385472298f384fc8
PDF	943d63ace373ee50d074daf84d357f8e5e62ff91c829d87f566bee453d715280
PDF	711c0aa8cde078aa349fb329e3e44e4272ea66a5e651ad8a64893c76a725c859
PDF	d910e08a11a4f6f764e7495f4602a00b6024ca6e1b70fe30ba3752b881574365
PDF	47d321c1a232e5cdd1e39a06dadbd79114dc1a2f0f8eac289e6b653a5d126f95
PDF	d13ad6fc5fda54e65f1214e554a5123126ac7b3ce6db57566ed7bd0e92d03d85
PDF	d04f68079ca90c65223a907f23fae5d068904a2145348b953b1d06e2eaf0bf2c
PDF	1b4d5c95f4fc037ca3c359cea5ca2da1285bbadab12bcdcb47f3dad8bc6fa8ed
PDF	62ef39ec29966d71c8254f68bd5e320cf24a042d76c12dbafdcc0766861827c5
PDF	1f1a89bef73e4866a198a08e750f96348ce2b82816a8353e9a8a574bfde5f491
PDF	ea8af591fe2d605c82bb7831d2ebdfb17cb2659880e1a8a7b0a2dd851dc5e7a3
PDF	0b4d962eef2d06abfe08a8cd0b15edd224d4fae0b57d708aebd77d99667616d5
PDF	c521b3a189b0089a2558aa4e42bd9fb5558e1b17917e2e183a4bd9cbcb2ed77e
PDF	0849a6b87fbef25089ad0be746f84047b080ba81898a8614da43d4ab60ef735a
Email	debe871710268e7bb770b72c6772f2e0b8bd40a22b2eabf4b6556eaba2d71057
Email	eaec8c6950f394ad5dcd271aa86f08cb2b8374203ecc67015af7ca6057244390
Email	995b1156562150c15970aa2d6b27f0b442d758594d820ec09d53d5e861fac457
Email	918dd413cceed3b8aeaa79e45d9d7b2030d73e2affa4339b8f9d043d08844f62
Email	be5a110ee72ebcf1b7d9e155308a8abc606bd446f8aec1a9f33cd06ca0f3c056
Email	dc62e645589463a61e6ac562d034a9de4ed897714389eb6b87bb02f0bd59d565
HTA	4302586202234cdf1ca058fd3c62be0050c8155ed113f3f62337d756e6915044
HTA	85767416f8d1e73833ccaa193263d1198857308b3a1185e6f4ebc4164db8584f
HTA	f1aa14ebfd2da477edba94b34f09f775485688b5958d82fcb072a837e27e246b
HTA	c477bdfae91e3df9be29e9eeba785467aff294f5250c2eed406765032cb68756
HTA	6e6bd2f7566ffa52d52fa9d5f048bbb9246d3d50110c6b0c248919ad796c6fd4
HTA	4540c3af3b1d8c52256f4580dd4d002fadb8c5ff4e32e6a41fdf508455c5b697
HTA	92a1428e125f33de012c7f52fb0827be3d7e90e38a0e38083181f8c3312adc9c
HTA	e57409c5e1f8287900c1c3b3e8c099cef537a02949315eb768c88906b0c65add
HTA	5a76669ec410d0b3e21112a4a6fd3207976b299ee27c5fc3d42f2673170ab95e
HTA	8092b9de455463296898fcaf8c9955d1c00dae6812c03bba019edf9c059ece33
HTA	99fcabf7c996d6ec077ccd745a158a3a395403d6a3df9d8da179f3cd5faf81b1
HTA	875e8d4137e1016b4be869e36e00a9414e89902fd5592a2fb881ebb0e4bd2f8b
HTA	bd724bbb27f9a71fd44f1c334b003541761071655fa585b64eed3bd78fc28e01
HTA	a42daeca71a6bdc79fd66b8b6ee413562abf7f72ef093292c86c1e9e7c2be456
HTA	7e04e86c07213fed7bebccd9953818b102b1b25b78e5f3707e81bad5054cf4e8
HTA	6547736c31dabb5bef2a290b32a72bf63b5c42dd2a33b5a6520159b41c43b093
HTA	51503ce1373c7fa72a1da5c5c4b30f88c8224686669ba4b64196591414fdc64c
HTA	5b3c2442831d4844ea6b86942f1a0ba27170018382cbc362343db63717d0ff02
HTA	71dea06c2271a46fc2fd6092e2ba0c2f5a2cf5ca8f955ee3375e3ca66a5dc52b
AutoIt script	fc820eeb054c781693eca78fed1c418f12b27da2c7c7e73281eb07b25cc7d910
AutoIt script	f76d09cbd455ce18765591b9efa3bde0d31358b6321f7a10fc2e04f65d7407ba
Casbaneiro payload	7de637539159dc17ceedb0aae783930ee68639b6d8036ef8147027c5ebca3fc8

Source: Fortinet’s published file indicators.

Network Indicators

Fortinet lists these domains and IP addresses without assigning a specific delivery, data theft, or C2 role to every entry.

Type	Indicator
Domain	128[.]200[.]178[.]68[.]host[.]secureserver[.]net
Domain	13[.]189[.]202[.]64[.]host[.]secureserver[.]net
Domain	116[.]181[.]62[.]50[.]host[.]secureserver[.]net
Domain	48[.]178[.]169[.]192[.]host[.]secureserver[.]net
Domain	115[.]201[.]178[.]68[.]host[.]secureserver[.]net
Domain	181[.]202[.]178[.]68[.]host[.]secureserver[.]net
Domain	135[.]201[.]178[.]68[.]host[.]secureserver[.]net
Domain	85[.]182[.]62[.]50[.]host[.]secureserver[.]net
Domain	162[.]201[.]178[.]68[.]host[.]secureserver[.]net
Domain	129[.]202[.]178[.]68[.]host[.]secureserver[.]net
Domain	76[.]180[.]62[.]50[.]host[.]secureserver[.]net
Domain	gexwalltool[.]com
Domain	x-wolverine[.]servebbs[.]com
IP address	72[.]167[.]48[.]63
IP address	209[.]99[.]188[.]28

Source: Fortinet’s published network indicators.

Cryptocurrency Addresses

Type	Address
Cryptocurrency address	0xb4c12078448fdef1f8881a55aab5c81fa194095c
Cryptocurrency address	bc1q7jt45630rw346729vk5cuatvfyvhfv0330u2p6

Source: Fortinet’s published cryptocurrency indicators.

Host Artifacts and Detection Names

These artifacts appear in Fortinet’s technical analysis. Placeholder values vary between infected systems, while legitimate Windows process names are useful only when assessed alongside suspicious behavior.

Artifact	Value or location	Purpose or relevance

Artifact	Value or location	Purpose or relevance
Download directory	C:{random name}	Stores the downloaded components
Compressed file suffix	crT	Helps the AutoIt loader locate the compressed payload
Startup shortcut	LNK file in the Windows Startup folder	Runs the AutoIt script through its interpreter
Infection marker folder	%PUBLIC%{ComputerName}@4{UserName}	Prevents repeated execution or reinfection
Mutex	GlobolID-4465173{Username}	Prevents concurrent malware execution
Outlook collection marker	%APPDATA%.Outlook	Tracks email-stealing activity
Victim marker folder	%TEMP%{MD5 hash}	Created after the expected HTTP 403 response
Victim marker registry key	HKCUSOFTWARE{MD5 hash}	Created after the expected HTTP 403 response
Primary injection target	RegSvcs.exe	Hosts the injected Casbaneiro payload
Fallback injection target	mobsync.exe	Used when RegSvcs.exe does not exist
FortiGuard detection	PDF/Phishing.5BB0!tr	Phishing PDF detection
FortiGuard detection	JS/Phishing.IBP!tr	JavaScript phishing detection
FortiGuard detection	W32/Casbaneiro.EN!tr.spy	Casbaneiro payload detection

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC

The post Casbaneiro Malware Hides C2 Activity Until Victims Visit Banking Websites appeared first on Cyber Security News.