Question 1

¿Qué es TCLBANKER y cómo se propaga?

Accepted Answer

TCLBANKER is a Brazilian banking trojan delivered through a trojanized Logitech installer. It hijacks victims' WhatsApp Web sessions and Outlook email accounts to send phishing messages to their contacts, according to Elastic Security Labs.

Question 2

¿Qué plataformas de criptomonedas tiene como objetivo TCLBANKER?

Accepted Answer

The trojan monitors an encrypted list of 59 Brazilian banking, fintech, and cryptocurrency domains. It activates a remote-control session when a victim visits any of those sites in their browser.

Question 3

¿Cómo evita TCLBANKER la detección por parte de investigadores de seguridad?

Accepted Answer

The malware generates an environment fingerprint from anti-debugging checks, system hardware, and language settings, then uses that fingerprint to decrypt its payload. If any check fails (sandbox detected, debugger attached, non-Brazilian locale), the payload never decrypts and execution stops silently.

Logitech

Un troyano brasileño secuestra WhatsApp para difundir phishing de criptomonedas

Un breve y afilado resumen.
Todos los días.

Logitech

Un troyano brasileño secuestra WhatsApp para difundir phishing de criptomonedas

Un breve y afilado resumen.Todos los días.

Un breve y afilado resumen.
Todos los días.