# Recorteiro: Rust banking trojan with 'Recort' screen-hole overlay fraud distributed via fake EnergiaLusa electricity bills in Portugal

> Recorteiro (Malpedia: win.recorteiro) is a Rust-based Windows banking trojan reported on 2026-11-05 that is distributed in Portugal behind fake electricity bills. It steals browser credentials and session data, targets Portuguese banks, and gives operators remote control of the victim's screen, keyboard and mouse.

- **Published:** 2026-11-09T09:00:34Z
- **Last reviewed:** 2026-11-09T09:00:34Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5535
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5535.png
- **ID:** TL-2026-5535
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 12 (1 shown free below)

## Description

Recorteiro was documented on 2026-11-05 by Pedro Tavares (Seguranca Informatica) and added to the Malpedia library as family win.recorteiro. The original article could not be retrieved during research (HTTP 403 from the publisher). The technical details below come from a secondary summary of that article published by CISOCLUB (itself sourced via CTT Report Hub) and have not been cross-checked against the primary report. Treat them as single-source.

Lure and delivery: the campaign uses fake electricity bills that impersonate a company named EnergiaLusa. According to the secondary summary, the delivery chain starts with a batch file run in a minimized window that sends a campaign beacon. The batch file uses curl.exe to download a PowerShell stage, which is run with the execution policy bypassed. The PowerShell dropper then downloads and runs a loader. The dropper checks for recently created or modified installation folders. The initial delivery vector (for example email attachment or link) is not stated in the accessible sources.

Persistence and loader: persistence is reported through a randomly named HKCU Run value, a scheduled task, and a Windows service. The loader supervises the main process, accepts digitally signed updates, and can roll back a build that crashes. It downloads an encrypted core of about 23 MB from the C2. Loader code is identical across samples, and file hashes differ because of added decoy files and per-build data.

Core implant: the Rust core is decrypted and written with a per-victim hash, and its configuration and strings are encrypted or obfuscated. At start-up it retrieves the current C2 address from Supabase, with windowshelpers.com as the fallback. C2 traffic runs over a TLS WebSocket. The core reports host information, installed security products, screen state and loader state. It inventories security tooling but does not try to disable it or kill its processes. It also sends analysis-environment signals to the operator, who decides whether to pause or block the agent.

Fraud and theft capabilities: target lists include Portuguese banks (Millennium bcp, Novo Banco, Santander, BPI), and the operator is notified when a target window and process match. The implant steals browser passwords, cookies, saved card data, history and localStorage from multiple browsers, and targets cryptocurrency wallets. To bypass Chrome App-Bound Encryption it runs code inside the browser process. A force-installed Chrome/Edge extension provides browser-level control and access to bank session data. Further capabilities are screenshots, H.264 video streaming over WebRTC, and remote keyboard and mouse control. The 'Recort' fraud mode shows a full-screen overlay with a hole through which the real bank page area is visible. The victim's input is confined to that area while the operator can type. Separate tooling supports affiliate-tagged loader delivery and campaign management.

Attribution: sources point to a Portugal-focused campaign with possible Brazilian links, but the operators have not been identified. No Malpedia actor is linked to the family. Malpedia has no description, YARA or aliases for the family yet. No file hashes, IPs or full domain lists were available in accessible sources, so the IOC set is limited to the indicators evidenced above.

## MITRE ATT&CK

- T1059.003 Windows Command Shell
- T1059.001 PowerShell
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1543.003 Windows Service
- T1176 Software Extensions
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1518.001 Security Software Discovery
- T1082 System Information Discovery
- T1113 Screen Capture
- T1071.001 Web Protocols
- T1573 Encrypted Channel
- T1008 Fallback Channels
- T1219 Remote Access Tools

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Recorteiro Delivery Chain - curl.exe Download Followed By PowerShell ExecutionPolicy Bypass** (`TL-2026-5535-SPL-001`)

Correlates, per host and 15-minute window, a curl.exe download of a script or file with a PowerShell ExecutionPolicy Bypass launch by cmd.exe or curl.exe. This is the Recorteiro (win.recorteiro, TL-2026-5535) fake EnergiaLusa electricity bill chain: batch file, curl.exe download, PowerShell dropper, loader.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059.003, T1059.001, T1105
- **Data sources:** sysmon (Event ID 1), index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| eval proc=lower(Image), parent=lower(ParentImage), cmd=lower(CommandLine)
| eval curl_dl=if(match(proc,"curl\.exe$") AND match(cmd,"https?://") AND match(cmd,"(\.ps1|\.bat|\.cmd|-o\s|--output)"),1,0)
| eval ps_bypass=if(match(proc,"(powershell|pwsh)\.exe$") AND match(cmd,"-e[a-z]*\s+bypass") AND match(parent,"(cmd|curl)\.exe$"),1,0)
| where curl_dl=1 OR ps_bypass=1
| bin _time span=15m
| stats sum(curl_dl) as curl_downloads sum(ps_bypass) as ps_bypass_runs values(CommandLine) as command_lines values(ParentCommandLine) as parent_command_lines by host User _time
| where curl_downloads>=1 AND ps_bypass_runs>=1
| table _time host User curl_downloads ps_bypass_runs command_lines parent_command_lines
```

### Microsoft KQL

```kql
let lookback = 24h;
let curl_dl = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName =~ "curl.exe"
| where ProcessCommandLine matches regex @"(?i)https?://"
| where ProcessCommandLine matches regex @"(?i)(\.ps1|\.bat|\.cmd|\s-o\s|--output)"
| project DeviceId, DeviceName, AccountName, CurlTime = Timestamp, CurlCmd = ProcessCommandLine, CurlParentCmd = InitiatingProcessCommandLine;
let ps_bypass = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine matches regex @"(?i)-e[a-z]*\s+bypass"
| where InitiatingProcessFileName in~ ("cmd.exe", "curl.exe")
| project DeviceId, PsTime = Timestamp, PsCmd = ProcessCommandLine;
curl_dl
| join kind=inner ps_bypass on DeviceId
| where PsTime between (CurlTime .. (CurlTime + 15m))
| project DeviceName, AccountName, CurlTime, CurlCmd, CurlParentCmd, PsTime, PsCmd
| order by CurlTime desc
```

### Sigma

```yaml
title: Recorteiro - PowerShell ExecutionPolicy Bypass Launched From Batch File
id: 3f6b1c52-8a47-4d19-9e0b-5c2a7d41e601
status: experimental
description: Detects PowerShell started with -ExecutionPolicy Bypass by cmd.exe running a .bat/.cmd file, the Recorteiro (win.recorteiro) delivery chain where a minimized batch stage runs a curl.exe-downloaded PowerShell dropper (TL-2026-5535).
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.recorteiro
    - https://seguranca-informatica.pt/recorteiro-a-rust-banking-trojan-that-cuts-holes-in-your-screen-and-hides-behind-fake-electricity-bills-in-portugal/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-09
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1059.003
    - attack.command-and-control
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_bypass:
        CommandLine|contains:
            - '-ExecutionPolicy Bypass'
            - '-ep Bypass'
            - '-Exec Bypass'
    selection_parent:
        ParentImage|endswith: '\cmd.exe'
        ParentCommandLine|contains:
            - '.bat'
            - '.cmd'
    condition: all of selection_*
falsepositives:
    - Legitimate software deployment or logon scripts that wrap PowerShell in a batch file
    - IT automation and installers that run PowerShell with a Bypass policy
level: high

```

**Known false positives:**

- Admin or deployment scripts that download with curl.exe and run PowerShell with Bypass
- Developer bootstrap scripts

**Tuning notes:** Exclude known admin hosts, service accounts and trusted software distribution URLs; widen the span if download and execution are separated by more than 15 minutes. Source details are single-source, so review hits manually.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Recorteiro Stage 1 - Batch File Using curl.exe To Download PowerShell Stage (locked: unlock with TL Creds)
- Recorteiro Persistence - Chrome Or Edge ExtensionInstallForcelist Modified (locked: unlock with TL Creds)
- Recorteiro C2 - Non-Browser Process Contacting Supabase Or [indicator] (locked: unlock with TL Creds)
- Recorteiro Dropper - PowerShell ExecutionPolicy Bypass Downloading Loader (locked: unlock with TL Creds)
- Recorteiro Persistence - Scheduled Task Or Service Created For User-Writable Binary (locked: unlock with TL Creds)
- Recorteiro C2 - User-Writable Process Resolving Supabase Or Fallback Domain (locked: unlock with TL Creds)
- Recorteiro Persistence - Run Key, Scheduled Task Or Service From User-Writable Path (locked: unlock with TL Creds)
- Recorteiro C2 - [indicator] Fallback Domain Resolution Or Connection (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 12)

Defanged, TLP:CLEAR.

- Domain: `windowshelpers[.]com`

Full set of 12 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Recorteiro: a Rust banking trojan that cuts holes in your screen and hides behind fake electricity bills in Portugal (Malpedia library entry)](https://malpedia.caad.fkie.fraunhofer.de/library/bbe6a42e-3a2b-4abe-a17e-9ac8c9cb6c7d/)
- [Recorteiro: a Rust banking trojan that cuts holes in your screen and hides behind fake electricity bills in Portugal (Seguranca Informatica, Pedro Tavares; original article, not retrievable: HTTP 403)](https://seguranca-informatica.pt/recorteiro-a-rust-banking-trojan-that-cuts-holes-in-your-screen-and-hides-behind-fake-electricity-bills-in-portugal/)
- [Malpedia family entry win.recorteiro](https://malpedia.caad.fkie.fraunhofer.de/details/win.recorteiro)
- [CISOCLUB: Campaign in Portugal spreads the Recorteiro banking trojan for Windows (Russian-language summary; source of technical details)](https://cisoclub.ru/kampanija-v-portugalii-rasprostranjaet-bankovskij-trojan-recorteiro-dlja-windows)
- [This Week in 4n6: Week 45 2026 (threat intelligence roundup listing Recorteiro)](https://thisweekin4n6.com/2026/11/08/week-45-2026/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5535