CPL-Malware-in-Brasil-zx02m.pdf

This report analyzes a widespread campaign in Brazil where malicious CPL (Control Panel) files are distributed via phishing (attachments, ZIPs, HTML refresh links and URL shorteners) to act as Trojan Downloaders—primarily Win32/TrojanDownloader.Banload—that retrieve and execute banking trojans to steal credentials. The paper provides technical reversal of CPIApplet payloads, a custom string decryption algorithm (with sample Python), anti-VM checks in DllMain, lists of 419 URLs and ~300 domains (many Brazilian), packer usage, campaign statistics showing large targeting of Brazilian users, and reproduction of propagation emails and IoCs.