# TCLBANKER Brazilian Banking Trojan — Trojanized Logi AI Prompt Builder DLL Sideload with WhatsApp and Outlook Worm Modules (REF3076)

> Elastic Security Labs disclosed TCLBANKER (REF3076), a major evolution of the MAVERICK/SORVEPOTEL Brazilian banking-trojan family that abuses DLL sideloading against the legitimate signed Logitech application Logi AI Prompt Builder via a malicious screen_retriever_plugin.dll. The loader is heavily environment-gated (anti-debug, anti-VM, ETW/NTDLL patching, Brazilian-Portuguese geo/locale checks) and decrypts two .NET Reactor-protected payloads: a UI Automation banking module that targets 59 Brazilian banking, fintech, and cryptocurrency domains using full-screen WPF social-engineering overlays, plus self-propagating WhatsApp Web (Selenium + WPPConnect) and Outlook (COM automation) worm modules. All C2 and distribution infrastructure is hosted on a single Cloudflare Workers account (ef971a42).

- **Published:** 2026-05-07T12:00:00Z
- **Last reviewed:** 2026-05-07T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0469
- **ID:** TL-2026-0469
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** REF3076 operator
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

TCLBANKER is a Brazilian-targeted banking trojan tracked by Elastic Security Labs as campaign REF3076 and disclosed publicly on 2026-05-07. The campaign is a major iteration of the MAVERICK family (Kaspersky tracking) and SORVEPOTEL (TrendMicro tracking), and shares infrastructure overlap with the Water Saci campaign at the legacy IP 191.96.224.96. The operator demonstrates strong operational maturity through layered anti-analysis, environment-gated payload decryption, signed-binary abuse, and self-propagation across two messaging platforms.

Delivery: victims receive a ZIP (e.g., XXL_21042026-181516.zip) containing an MSI which drops a directory under %LocalAppData%\LogiAI containing a renamed legitimate copy of Logi AI Prompt Builder (LogiAiPromptBuilder.exe, a Flutter desktop application) alongside a malicious screen_retriever_plugin.dll. When the signed Logitech binary loads its DLL search path, the malicious DLL is sideloaded (T1574.002), inheriting the trust of the legitimate signed parent.

Loader anti-analysis: the sideloaded DLL implements six anti-debug checks (PEB BeingDebugged, heap flags, NtQueryInformationProcess ProcessDebugPort and ProcessDebugObjectHandle, hardware debug registers DR0-DR3, and QueryPerformanceCounter/RDTSC timing deltas), five sandbox/VM checks (hypervisor vendor signature for VMware/VirtualBox/KVM/Xen/Parallels/QEMU, ≥64GB disk, ≥2GB RAM, ≥2 logical processors, common analyst usernames), Brazilian geofencing (GetUserGeoID == 0x20, locale 0x0416 pt-BR, timezone offset -2.0), sleep-bypass detection, ETW patching of EtwEventWrite (xor eax,eax / ret), NTDLL unhooking via disk replacement, direct syscall trampolines, and a watchdog enumerating 14 analysis tool process names, 13 debugger/analysis window titles, 9 IDA/CheatEngine/etc. window classes, 12 sandbox modules (SbieDll.dll, cuckoomon.dll, dbeng.dll), and Frida/IDA named-pipes/mutexes, with .text section CRC32 integrity validation. Payload AES-256-CBC keys are derived from a fingerprint hash of the environment, so an incorrect host silently fails decryption.

Banking module (Tcl.Agent): a .NET Reactor-protected component that polls the foreground browser address bar every second using UI Automation (AutomationElement.FromHandle / ValuePattern.Current.Value) across Chrome, Firefox, Edge, Brave, Opera, and Vivaldi. When a victim navigates to one of 59 hard-coded Brazilian banking, fintech, or cryptocurrency domains (XOR+base64 encrypted), the operator is paged and a WPF full-screen, borderless, topmost overlay is rendered, hidden from screen capture via SetWindowDisplayAffinity(WDA_EXCLUDEFROMCAPTURE), with low-level keyboard/mouse hooks (WH_KEYBOARD_LL, WH_MOUSE_LL) blocking Tab/Esc/Alt+F4/Win/PrintScreen/Ctrl/Alt/nav keys plus right- and middle-clicks. Overlay variants include a credential prompt with Brazilian phone-number formatting and rejection of repeating/sequential digit patterns, a vishing screen with breathing animation, operator-templated 15-minute progress sequences, a fake Windows Update screen, and a transparent cutout overlay that exposes the underlying real banking window. Operator C2 opcodes cover registration (2), session control (4-7), screenshot/streaming (16-20), input injection and keylogging (32-41), and file/process/shell/window operations plus credential overlay (48-96).

Worm module (Tcl.WppBot): scans Chromium-family browser profiles for active WhatsApp Web sessions by detecting IndexedDB at https_web.whatsapp.com_0.indexeddb.leveldb, clones the profile to %TEMP%\<GUID>\, launches headless Chromium via Selenium WebDriver (chromedriver resolved by Selenium Manager via a hostfxr.exe binary disguised under %TEMP%\msvc-rt14\bin\), injects bot-detection bypasses (hides navigator.webdriver, fakes chrome.runtime, sets navigator.languages to pt-BR/pt/en-US/en), then injects WPPConnect (WA-JS) to harvest contacts (filtering groups, broadcasts, and non-Brazilian numbers) and broadcast a campaign message with the reconstructed TCLBANKER payload as a File object — no disk drop. The Outlook variant attaches via COM (Marshal.GetActiveObject("Outlook.Application")), validates account presence, drops a PowerShell contact harvester at %TEMP%\oc<guid>.ps1, and sends a Portuguese-language NF-e-themed phishing email ("Prezado(a), NFe disponível para impressão") with an HTML "Abrir Nota Fiscal" button linking to arquivos-omie.com. Captured campaign config caps WhatsApp at 3000 messages/session (1-3s delay) and Outlook at 100 messages/session (30-90s delay), and reports progress to /api/progress with control polling at /api/control.

Infrastructure: the entire campaign is hosted on Cloudflare Workers under account ef971a42 — campagna1-api.ef971a42.workers.dev (C2 backend with HMAC-SHA256 handshake key 70e4f943-e323-4484-97d7-35401bf6812c), documents.ef971a42.workers.dev (payload CDN), and mxtestacionamentos.com (WebSocket C2) — alongside phishing/staging domains arquivos-omie.com, documentos-online.com, afonsoferragista.com, doccompartilhe.com, and recebamais.com (registered between 2026-04-11 and 2026-04-22). Persistence is established via a hidden logon-triggered scheduled task named RuntimeOptimizeService and configuration files flutter_engine.cfg / version.hash. Developer artifacts (debug logging at C:\temp\tcl-debug.txt and a tclloader.exe reference in allowlists) suggest the campaign was identified during early operational stages.

## MITRE ATT&CK

- T1566 Phishing
- T1218 System Binary Proxy Execution
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1053 Scheduled Task/Job
- T1574 Hijack Execution Flow
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1622 Debugger Evasion
- T1497 Virtualization/Sandbox Evasion
- T1685 Disable or Modify Tools
- T1055 Process Injection
- T1057 Process Discovery
- T1010 Application Window Discovery
- T1082 System Information Discovery
- T1614 System Location Discovery
- T1113 Screen Capture
- T1056 Input Capture
- T1115 Clipboard Data
- T1185 Browser Session Hijacking
- T1114 Email Collection
- T1071 Application Layer Protocol
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1529 System Shutdown/Reboot

## Sources

- [TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook](https://www.elastic.co/security-labs/tclbanker-brazilian-banking-trojan)
- [TCLBANKER IOC and target domain gist (Jia Yu Chan)](https://gist.github.com/jiayuchann/e298effb68bd472c9e577a630d0ceb20)
- [MAVERICK banker distributing via WhatsApp](https://securelist.com/maverick-banker-distributing-via-whatsapp/117715/)
- [Self-propagating malware spreads via WhatsApp (SORVEPOTEL)](https://www.trendmicro.com/en_us/research/25/j/self-propagating-malware-spreads-via-whatsapp.html)
- [MITRE ATT&CK T1574.002 — Hijack Execution Flow: DLL Side-Loading](https://attack.mitre.org/techniques/T1574/002/)
- [MITRE ATT&CK T1218.007 — System Binary Proxy Execution: Msiexec](https://attack.mitre.org/techniques/T1218/007/)
- [MITRE ATT&CK T1497 — Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0469