GoPix Banking Trojan Uses In-Memory Implants to Intercept Brazilian Financial Transactions
Summary
Kaspersky researchers detail GoPix, a Brazilian banking trojan delivered through malvertising. It uses obfuscated PowerShell and in-memory browser implants to manipulate Pix, Boleto and cryptocurrency transactions and intercept HTTPS traffic.
Key points
- GoPix is distributed through malvertising, often using fake software installers; the campaign has been active since December 2022.
- Delivery uses signed NSIS installers or ZIP files containing LNK shortcuts, with a stolen code-signing certificate used to sign malicious installers.
- Obfuscated PowerShell and shellcode load the malware into memory, while direct syscalls and browser process injection help limit disk artifacts and evade analysis.
- GoPix monitors Pix and Boleto transactions and can replace copied Bitcoin or Ethereum wallet addresses with attacker-controlled addresses.
- Malicious PAC files and trusted root certificates injected into browser memory enable interception and manipulation of HTTPS traffic to targeted financial sites.
- The operators use anti-fraud and reputation services to screen targets and short-lived C2 servers to complicate analysis and incident response.
Article Details
- Attack Vectors
- Malvertising through Google Ads directs users to malicious landing pages offering fake installers, including a fake “WhatsApp Web installer.”
- Delivery uses either a signed NSIS installer or a ZIP archive containing an LNK shortcut that runs obfuscated PowerShell.
- PowerShell retrieves and executes later stages, which decrypt and load GoPix components in memory.
- GoPix injects its main implant into a browser process and uses malicious PAC configuration and an injected root certificate to intercept and manipulate HTTPS traffic.
- The malware monitors clipboard transactions, reporting Pix and Boleto activity to C2 and replacing copied Bitcoin or Ethereum wallet addresses.
- Defensive Notes
- Kaspersky products detect GoPix as HEUR:Trojan-Banker.Win64.GoPix, Trojan.PowerShell.GoPix, and HEUR:Trojan-Banker.OLE2.GoPix.
- The article reports memory-only execution and short-lived C2 servers, which leave few disk artifacts and complicate YARA-based hunting and DFIR.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | c2paletolife[.]com | Listed as a GoPix C2 domain. |
| DOMAIN | paletolife[.]com | Listed as a GoPix C2 domain. |
| MD5 | 28c314acc587f1ea5c5666e935db716c | Hash of the GoPix main payload. |
| MD5 | d3a17cb4cdba724a0021f5076b33a103 | Hash of the GoPix malware dropper. |
| MD5 | eb0b4e35a2ba442821e28d617dd2daa2 | Hash of a malicious GoPix NSIS installer. |
| SHA1 | 1b1f85b68e6c9fde709d975a186185c94c0faa51 | Thumbprint of a malicious root certificate injected into browser memory; identified as CN=Root CA 2025. |
| SHA1 | f110d0bd7f3bd1c7b276dc78154dd21eef953384 | Thumbprint of a malicious root certificate injected into browser memory; identified as CN=Root CA 2024. |
| URL | hxxp[:]//4a3d[.]com/1/ | GoPix campaign URL listed among domains and URLs used for distribution and C2. |
| URL | hxxp[:]//9de1[.]com/1/ | GoPix campaign URL listed among domains and URLs used for distribution and C2. |
| URL | hxxp[:]//b3d0[.]com/1/ | GoPix campaign URL listed among domains and URLs used for distribution and C2. |
| URL | hxxp[:]//ef0h[.]com/1/ | GoPix campaign URL listed among domains and URLs used for distribution and C2. |
| URL | hxxp[:]//webmensagens4bb7[.]com/ | GoPix campaign URL listed among domains and URLs used for distribution and C2. |
| URL | hxxp[:]//yogarecap[.]com/1/ | GoPix campaign URL listed among domains and URLs used for distribution and C2. |
| URL | hxxps[:]//correioez0ubcfht9i3[.]lovehomely[.]com/ | GoPix campaign URL listed among domains and URLs used for distribution and C2. |
| URL | hxxps[:]//correiotwknx9gu315h[.]lovehomely[.]com/ | GoPix campaign URL listed among domains and URLs used for distribution and C2. |
| URL | hxxps[:]//mydigitalrevival[.]com/get.php | GoPix campaign URL listed among domains and URLs used for distribution and C2. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationGoPix uses encrypted strings and shellcode, obfuscated scripts, and multiple obfuscation layers.T1055 · Process InjectionThe dropper launches a browser process suspended and injects GoPix shellcode into it.T1059.001 · PowerShellObfuscated PowerShell collects system information, retrieves configuration and payloads, and executes decrypted code in memory.T1071.001 · Web ProtocolsGoPix communicates with C2 and retrieves payloads and configuration over HTTP/HTTPS.T1105 · Ingress Tool TransferThe infection chain downloads next-stage payloads and remotely retrieved PowerShell scripts from malicious URLs.T1115 · Clipboard DataGoPix monitors and replaces clipboard contents, including copied cryptocurrency wallet addresses, and captures Pix and Boleto transaction data.T1189 · Drive-by CompromiseGoPix operators use Google Ads malvertising to direct victims to malicious landing pages.T1204 · User ExecutionVictims are lured into running fake software installers or an LNK shortcut that launches the infection chain.T1497 · Virtualization/Sandbox EvasionThe campaign uses anti-fraud and reputation checks to identify sandboxes or analysis environments and withhold payloads from them.T1553.002 · Code SigningA stolen code-signing certificate was used to sign malicious NSIS installers.T1557 · Adversary-in-the-MiddleMalicious PAC files and a root certificate injected into browser memory let GoPix intercept and manipulate HTTPS traffic.
Malware
Vendors
AvastThis port is used by the Avast Safe Banking feature, present in many Avast products, which are very popular in countries like Brazil. If the port is open, the victim is led to download the first-stage payload from theGoogleGoPix is an advanced Brazilian banking trojan that uses malvertising via Google Ads, stolen code-signing certificates, obfuscated PowerShell, memory-only implants, and short-lived C2s to target internet banking users,
Products
Avast Safe BankingThis port is used by the Avast Safe Banking feature, present in many Avast products, which are very popular in countries like Brazil. If the port is open, the victim is led to download the first-stage payload from theAvast Safe BrowserIt’s highly likely this method is used because Avast Safe Browser blocks direct downloads of executable files, so instead of downloading the executable NSIS installer, a ZIP file is delivered.EdgeIt then sequentially checks for installed browsers — Chrome, Firefox, Edge, and Opera — retrieving the full path of the first detected browser from the registry key SOFTWAREMicrosoftWindowsCurrentVersionApp Paths.Google AdsGoPix is an advanced Brazilian banking trojan that uses malvertising via Google Ads, stolen code-signing certificates, obfuscated PowerShell, memory-only implants, and short-lived C2s to target internet banking users,Google ChromeThe threat actors in most cases use Google Ads to spread baits related to popular services like WhatsApp, Google Chrome, and the Brazilian postal service Correios and lure victims to malicious landing pages.Mozilla FirefoxIt then sequentially checks for installed browsers — Chrome, Firefox, Edge, and Opera — retrieving the full path of the first detected browser from the registry key SOFTWAREMicrosoftWindowsCurrentVersionApp Paths.OperaIt then sequentially checks for installed browsers — Chrome, Firefox, Edge, and Opera — retrieving the full path of the first detected browser from the registry key SOFTWAREMicrosoftWindowsCurrentVersionApp Paths.WhatsApp WebInitial access is achieved through malvertising campaigns (Google Ads) that lure victims to malicious landing pages offering fake installers (e.g., “WhatsApp Web installer”).