Grandoreiro Banking Trojan Resurfaces via DLL Side‑Loading of Legitimate Duplicate Files Finder
What Happened – The Grandoreiro banking trojan, previously disrupted in 2024, has reappeared in a campaign that hijacks the legitimate Duplicate Files Finder utility. Attackers rename the executable and drop a malicious mingwm10.dll alongside it; when the trusted app runs, it loads the malicious DLL, allowing the trojan to execute while appearing benign. The malware performs extensive anti‑analysis checks and contacts its command‑and‑control server over DNS‑over‑HTTPS on TCP 6432.
Why It Matters for Compliance & Audit Readiness
- Demonstrates a control‑gap where approved‑software inventories and application whitelisting can be bypassed – a scenario SOC 2 CC6.1 (Change Management) is designed to prevent and evidence.
- Highlights the need for continuous monitoring of binaries and DLL loads to provide a defensible audit trail of unauthorized code execution.
- Aligns with Verisq’s Control Mapping capability, which automates evidence collection for software‑inventory controls and maps gaps to SOC 2 requirements.
Who Is Affected – Financial‑services firms and other enterprises with large endpoint fleets in Latin America (Mexico, Spain, Peru, Argentina) that rely on unmanaged or legacy utilities.
Recommended Actions
- Refresh software inventory and enforce strict whitelisting of executables and DLLs.
- Deploy continuous endpoint monitoring to detect anomalous DLL loading into trusted processes.
- Capture change‑control evidence (approval logs, hash verification) to satisfy SOC 2 CC6.1 audit requirements.
Technical Notes – The side‑loading technique leverages the legitimate Duplicate Files Finder binary, replaces it with a renamed version, and supplies a malicious mingwm10.dll. The trojan checks for 49 analysis‑tool processes, uses geolocation blacklists, and resolves its C2 domain via Google DoH before sending encrypted payload requests over TCP 6432. Source: DataBreachToday