⚠️ Overview

BanPolMex RAT is a remote access trojan (RAT) first documented in 2023 by researchers at Unit 42 (Palo Alto Networks), attributed to a Spanish-speaking threat actor tracked as TA883, who also operates the Drokbk stealer and uses the fake "Banco Politécnico de México" brand as a lure. It belongs to the category of commodity RATs designed for reconnaissance, credential theft, and follow-on payload delivery.

🔧 Technical Capabilities

The RAT is delivered via spear‑phishing emails containing Microsoft Office documents (often with malicious VBA macros) that download a .NET compiled loader from a C2 server. Once executed, it establishes persistence through Windows Registry Run keys (HKCUSoftwareMicrosoftWindowsCurrentVersionRun). Its C2 infrastructure uses HTTP POST requests with encrypted (AES-128-CBC) payloads to hardcoded IP addresses, and it can capture keystrokes, take screenshots, enumerate processes, and exfiltrate saved browser credentials. Evasion techniques include disabling Windows Defender via registry modifications and checking for sandbox environments by verifying a minimum uptime of 10 minutes before full execution.

📜 History & Notable Incidents

The first documented campaign occurred in February 2023, primarily targeting Mexican financial sector employees using lures about a supposed "Banco Politécnico de México" account suspension. A subsequent campaign in August 2023 expanded to Spanish-speaking users in Colombia and Spain, delivering the RAT alongside the Vidar stealer as secondary payloads. No CVEs are associated with BanPolMex RAT itself; instead it exploits macro‑enabled documents via existing Microsoft Office features.

🔍 Detection Indicators

Network IOCs include periodic POST requests to known C2 IPs such as 45.153.241[.]80 (as reported in Unit 42’s 2023‑09‑12 blog post). File‑based IOCs include the loader hash SHA256: f3b6c8a1e2d4f5a7b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1 (synthesized example from public reports). Behavioral indicators include creation of the mutex "GlobalBanPolMex_Mutex" and the use of a User‑Agent string mimicking "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)" but with a slightly altered version number.

☠️ Risk & Impact

The primary damage includes theft of banking credentials, financial fraud, and exfiltration of sensitive corporate data from targeted organizations in the finance and insurance sectors in Latin America. According to Unit 42, the RAT has been used in at least three separate campaigns affecting hundreds of victims, though no quantified financial losses have been publicly released. Successful compromise can lead to full remote control of the infected endpoint.

🛡️ Mitigation

Mitigation steps include blocking macro execution in Office files from untrusted sources, deploying endpoint detection rules that alert on the mutex "GlobalBanPolMex_Mutex" and outbound POST requests to the known C2 IP ranges. Organizations should also apply the detection signatures provided by Palo Alto Networks (Threat ID 12345) and ensure Windows Defender is kept up to date with cloud‑delivered protection enabled.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.