# Grandoreiro Banking Trojan Targets Mexico via Duplicate Files Finder DLL Sideloading (mingwm10.dll)

> Acronis TRU reports a May 2026 Grandoreiro (Delphi-based banking trojan) campaign that sideloads a malicious mingwm10.dll through a renamed, legitimate Duplicate Files Finder executable. June 2026 telemetry shows activity concentrated in Mexico, followed by Spain and other Latin American countries; delivery is assessed with moderate confidence to be spam carrying ZIP archives.

- **Published:** 2026-10-14T12:39:08Z
- **Last reviewed:** 2026-10-14T12:39:08Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3504
- **ID:** TL-2026-3504
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Grandoreiro is a Delphi-based banking trojan active since 2016 and historically associated with Brazilian operators targeting Spanish- and Portuguese-speaking countries. After the January 2024 INTERPOL/Brazilian Federal Police disruption, Acronis TRU observed a renewed campaign in May 2026 with a new loader technique and heavier anti-analysis.

Infection chain: a ZIP archive (example: Fac-BH22DC0608_RevMQKSAC.zip) contains decoy PDFs and a legitimate Duplicate Files Finder executable renamed to a lure-style name (e.g. _2IH4ENJIRRNCobran_03732qyykae214BKXXN6180-Dt.exe). When run, the executable loads dupfdll.dll, which in turn loads the malicious mingwm10.dll (DLL side-loading, masquerading as the MinGW runtime library). On failure or analysis detection the malware shows a Spanish-language-themed document error message and asks the user to restart. Delivery is assessed with moderate confidence to be spam with ZIP attachments.

Anti-analysis: the loader requires system uptime of at least 180,000 ms; checks for desktop shortcuts of common applications (Chrome, CCleaner, Firefox, FileZilla, Acrobat Reader DC, Edge, Skype); evaluates physical memory, processor count, disk space and screen resolution; looks for VirtualBox/VMware drivers, BIOS registry values containing VBOX/VMWARE/VIRTUAL/QEMU/XEN/INNOTEK and VMware Tools registry keys; blocks execution when 49 analysis-tool processes are running (Procmon, Wireshark, x64dbg, Ghidra, Frida, Fiddler, etc.); blacklists known sandbox usernames/hostnames and analyst directories (e.g. C:\TOOLS\ProcessInvestigator\); and queries ip-api.com to exclude victims in CZ, RU and NL. Strings are protected with a Base64 (no padding) plus XOR scheme using an embedded key and salt.

Command and control: C2 hostnames are resolved via DNS-over-HTTPS (dns.google/resolve), after which the bot issues encrypted HTTP GET requests over TCP/6432. The protocol uses Portuguese-language tokens such as CLIENT_SOLICITA_DDS_MDL, CLIENT_ENVIA_STATUS, SOLICITADO, RECUPERADO, INFECTADO, AV_COMEU_MODULO, ERRO_EXECUCAO, ERRO_FALHA_DOWNLOAD and ERRO_EXTRACAO. The decrypted check-in carries country, city, hostname, username, OS version, installed security product, a bot identifier and date/time fields. Acronis published 6 C2 domains and 17 SHA256 hashes. No CVE is involved; severity is analyst-assigned.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1574 Hijack Execution Flow
- T1574.001 DLL
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1564.003 Hide Artifacts: Hidden Window
- T1082 System Information Discovery
- T1614 System Location Discovery
- T1057 Process Discovery
- T1071.001 Application Layer Protocol: Web Protocols
- T1071.004 Application Layer Protocol: DNS
- T1571 Non-Standard Port

## Sources

- [Grandoreiro goes north: from Brazil to Mexico with a new DLL sideloading campaign](https://www.acronis.com/en/tru/posts/grandoreiro-goes-north-from-brazil-to-mexico-with-a-new-dll-sideloading-campaign/)
- [Disrupting a Grandoreiro malware operation (INTERPOL)](https://www.interpol.int/news-and-events/news/2024/disrupting-a-grandoreiro-malware-operation)
- [Brazilian Feds Dismantle Grandoreiro Banking Trojan, Arresting Top Operatives (The Hacker News)](https://thehackernews.com/search/label/Grandoreiro)
- [Brazilian police arrest Grandoreiro gang (Risky Business)](https://risky.biz/brazilian-police-arrest-grandoreiro-gang/)
- [Grandoreiro malware revives following police action (TechRadar)](https://www.techradar.com/pro/security/this-wide-ranging-trojan-has-returned-from-the-dead-grandoreiro-malware-revives-following-police-action)
- [MITRE ATT&CK T1574.002 DLL Side-Loading](https://attack.mitre.org/techniques/T1574/002/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3504