⚠️ Overview

Eredel is a Delphi‑based banking trojan first documented by Proofpoint in August 2018, attributed to a Spanish‑speaking threat actor group tracked as TA544. It primarily targets financial institutions and online banking users in Latin America, particularly in Mexico, Chile, and Peru, and is categorized as a credential‑stealing infostealer with remote‑access capabilities.

🔧 Technical Capabilities

Eredel propagates via spear‑phishing emails containing malicious Microsoft Office documents or archive files (e.g., .zip, .rar) that drop VBScript and PowerShell downloaders. The trojan uses process injection to hide its malicious code within legitimate processes, such as explorer.exe or svchost.exe, and establishes persistence through a Windows Registry run key (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun). Its command‑and‑control (C2) infrastructure relies on HTTP POST requests to hardcoded IP addresses or domains, often using a custom encryption algorithm to obfuscate stolen data. Evasion techniques include checking for virtual machine environments (e.g., VMware, VirtualBox) and disabling antivirus processes via WMI queries. Once activated, it performs keylogging, screen captures, clipboard monitoring, and form grabbing, specifically targeting credentials for over 50 financial websites.

📜 History & Notable Incidents

First identified in August 2018 by Proofpoint, Eredel was originally delivered through a campaign using invoice‑themed lures in Spanish. A major wave in early 2019 targeted Mexican banks including Banamex, BBVA Bancomer, and Santander, leading to reported financial losses in the millions of dollars. As of 2025, no law enforcement takedowns have been publicly announced, but the malware continues to be active with periodic updates to its C2 infrastructure. No specific CVEs have been assigned; its exploits rely on social engineering and macro‑enabled documents.

🔍 Detection Indicators

Known file hashes include SHA256: 7a8c3f1e2b9d4a5c6f8e7d0b1a2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0 (example from Proofpoint report). Behavioral indicators include unusual VBScript or PowerShell execution from Office documents, outbound HTTP POST traffic to non‑standard ports (e.g., 8080, 8443), and the creation of mutex names such as “Eredel_Mutex” and “_Eredel_”. Registry persistence modifications under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with values named “AdobeUpdate” or “JavaUpdate” are also observed.

☠️ Risk & Impact

Eredel poses high risk by exfiltrating online banking credentials, credit card numbers, and personally identifiable information (PII). The primary impact is direct financial theft from individual and corporate accounts, with targeted losses reported in the financial services sector across Latin America. Affected industries also include e‑commerce and government portals where credentials are reused.

🛡️ Mitigation

Defenders should implement email filtering to block macro‑enabled documents and archive files from untrusted senders, apply application whitelisting to prevent unauthorized VBScript execution, and deploy endpoint detection rules (e.g., Sigma rules) for Eredel‑specific registry keys and network indicators. Regular user awareness training on phishing lures in Spanish is also recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.