JavaliMalware
Javali is a banking trojan that has targeted Portuguese and Spanish-speaking countries since 2017, primarily focusing on customers of financial institutions in Brazil and Mexico.From MITRE ATT&CK
Last reported 5 months ago, by Trend Micro Research1 report
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1027.016Junk Code Insertion
“Every served payload differs in variable names, function names, .NET type-name fragmentation, junk-code insertions, XOR keys, and AES-encrypted code blobs, making file-hash detection essentially impossible at population scale (Figure 5).”
- T1053.005Scheduled Task
“The script established persistence by invoking PS_ScheduledTask.ExecMethod(RegisterByUser), which registered a hidden scheduled task configured to execute powershell.exe with -WindowStyle Hidden, -ExecutionPolicy Bypass, and an encoded PowerShell command.”
- T1055Process Injection
“…or remote access trojan (RAT) that splits its capabilities across multiple Add-Type calls to build up a complex functionality like process injection, credential access, and C&C communication modules.”
- T1056.001Keylogging
“Once active, it enables operator-driven fraud through remote input control, keylogging, screen streaming, and Pix QR code interception targeting Brazilian financial institutions.”
- T1684Social Engineering
“Operator can push text popups to the victim screen (social engineering).”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud“…ecosystem that public reporting groups under the "Tetrade" umbrella, encompassing Grandoreiro, Casbaneiro/Casabeneiro, Mekotio, Guildma, Javali, and the more recent CHAVECLOAK.”
Indicators in its reports
named in the reports above- 162.141.111[.]227in 1 report
- hxxps://convitemundial2026[.]com/Consultar_NF-e.batin 1 report
- convitemundial2026[.]comin 1 report
- hxxp://24.199.90[.]58/payload.phpin 1 report
- 24.199.90[.]58in 1 report
- windowsk-cdn[.]comin 1 report
- c.windowsk-cdn[.]comin 1 report
- cdn[.]comin 1 report
- ecdc8fade561a75d…e90ecab1c47fin 1 report
- 38dfeb772afbd01c…23ad06e39d8fin 1 report
- 4912b1134e69ade7…44c6dfcf2ff1in 1 report
- d7545b6dacebdae2…9ba56a70cdaain 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.