{"id":1374,"date":"2025-06-07T00:55:56","date_gmt":"2025-06-07T00:55:56","guid":{"rendered":"https:\/\/blog.scilabs.mx\/en\/?p=1374"},"modified":"2025-06-07T00:55:56","modified_gmt":"2025-06-07T00:55:56","slug":"golden-piranha-a-new-threat-discovered-by-scilabs","status":"publish","type":"post","link":"https:\/\/blog.scilabs.mx\/en\/2025\/06\/07\/golden-piranha-a-new-threat-discovered-by-scilabs\/","title":{"rendered":"Golden Piranha, a new threat discovered by SCILabs"},"content":{"rendered":"
\n
\"\"<\/figure><\/div>\n\n\n

This report aims to describe the TTPs and provide indicators of compromise related to a new banking trojan identified and named by SCILabs as Golden Piranha<\/em>. One of the characteristics of this threat is the use of malicious Google Chrome extensions to steal information entered by users in banking website forms (described later in this report). The stolen data is sent to the operators via an open WebSocket connection<\/a>.<\/p>\n\n\n\n

The main objective of Golden Piranha<\/em> is to steal information from financial institutions, particularly in Brazil, such as Banco do Brazil and Banco Caixa, through the Man-in-the-Browser <\/a>technique.<\/p>\n\n\n\n

Although SCILabs could not recover this trojan’s initial access method, based on the evidence described in the investigation, evidence uncovered during the investigation strongly suggests that it was distributed via phishing emails that appear to be linked to the national firefighting system.<\/p>\n\n\n\n

Based on malware research and analysis, SCILabs determined, with a high confidence level, that the Golden Piranha<\/em> campaigns observed up to this report were targeted at Brazil.<\/p>\n\n\n\n

Furthermore, some of the artifacts identified during the investigation and used in the infection chain have not been detected by some of the security solutions included in the VirusTotal platform, thereby increasing the risk of compromise for employees at various organizations. Companies must remain alert to this threat.<\/p>\n\n\n\n

How could Golden Piranha<\/em> affect an organization?<\/h1>\n\n\n\n

Golden Piranha<\/em> can steal banking information belonging to all users, including organizational employees. If an attack within an organization is successful, cybercriminals can leak or sell stolen information on clandestine Dark Web forums or the black market, posing a threat to the \u00a0confidentiality, integrity, and availability of information and potentially causing financial and reputational losses.<\/p>\n\n\n\n

Analysis<\/h1>\n\n\n\n

Threat context<\/strong><\/h2>\n\n\n\n

Through open source intelligence processes and continuous monitoring of threats in the Latin American region, between the first and second weeks of April 2025, SCILabs identified the URL hxxps[:]\/\/almeida[.]clientepj[.]com<\/strong>, which corresponds to a site that hosted various legitimate and malicious files (described in the next section of this report), among which the different droppers used during the Golden Piranha<\/em> infection chain were located.<\/p>\n\n\n

\n
\"\"
Figure 1. Fragment of some files found on the storage server<\/strong><\/figcaption><\/figure><\/div>\n\n\n

Technical summary<\/strong><\/h2>\n\n\n\n

SCILabs analyzed all files and directories found within the storage repository used by the Golden Piranha<\/em> operators, obtaining the results shown in Table 1.<\/p>\n\n\n\n

Among the legitimate artifacts, installers for the Syncro <\/a>remote administration tool were identified, as described by SCILabs in a previous report, released in April of this year, after where its observed distribution was a malicious campaign impersonating the Attorney General’s Office (Mexico). It is also relevant to mention that adversaries have recently focused on distributing and installing remote administration tools. Hence, SCILabs hypothesizes, with a medium level of confidence, that the Golden Piranha<\/em> operators may use this mechanism soon.<\/p>\n\n\n\n

File name<\/strong><\/strong><\/td>Description<\/strong><\/strong><\/td><\/tr>
NotaFiscal25.exe<\/strong> (SCILabs did not identify that it was used during the infection chain) Nf-e25.exe<\/strong> (SCILabs did not identify that it was used during the infection chain)<\/td>Legitimate binaries of Syncro Remote Manangement Tool<\/td><\/tr>
nfee.exe<\/strong> (SCILabs did not identify that it was used during the infection chain) nfe010425.exe<\/strong> (SCILabs did not identify that it was used during the infection chain)<\/td>Legitimate Proceso Trabalhista<\/a> executable that makes a system validation<\/td><\/tr>
avast.exe<\/strong> (SCILabs did not identify that it was used during the infection chain)<\/td>Legitimate Avast installer<\/a><\/td><\/tr>
bola.exe<\/strong> (SCILabs did not identify that it was used during the infection chain)<\/td>Binary associated with Amadey<\/a><\/td><\/tr>
resultados.txt<\/strong><\/td>A plain text file with URLs most likely used by Golden Piranha<\/em> operators<\/td><\/tr>
naosei.msi<\/strong><\/td>Golden Piranha<\/em> dropper (explained in detail later in this report)<\/td><\/tr>
NotaFiscal1.25.bat<\/strong><\/td>Golden Piranha<\/em> dropper (explained in detail later in this report)<\/td><\/tr>
Proceso Trabalhista.bat<\/strong><\/td>Golden Piranha<\/em> dropper (explained in detail later in this report)<\/td><\/tr>
cliente.ps1<\/strong><\/td>Golden Piranha<\/em> dropper (explained in detail later in this report)<\/td><\/tr><\/tbody><\/table>
Table 1. Description of the files found at the attacker\u2019s server by SCILabs<\/strong><\/figcaption><\/figure>\n\n\n\n

SCILabs could not determine the distribution of Golden Piranha<\/em>; however, based on experience with similar infections and the content found in the resultados.txt<\/em> <\/strong>file, we believe with a high level of confidence that it is spread via mass phishing email campaigns.<\/p>\n\n\n

\n
\"\"
Figure 2. Fragment of the file resultados.txt<\/strong><\/figcaption><\/figure><\/div>\n\n\n

In addition to the results.txt<\/strong> file, SCILabs identified three artifacts of interest due to their content and the subsequent infection they initiate. These files correspond to the Golden Piranha<\/em> droppers. Their functionalities are detailed below:<\/p>\n\n\n\n