JanelaRAT
JanelaRAT is a Latin America-focused banking trojan and remote access malware family, active since June 2023, derived from and described as a modified version of BX RAT. It is named after the Portuguese word "janela" ("window") and is designed to steal financial and cryptocurrency-related data from selected banks and financial institutions, with Brazil and Mexico repeatedly identified as key targets; other reporting in the provided content also mentions Chile, Colombia, and Mexico. The malware has been observed in campaigns affecting users and organizations in Mexico and is associated with persistent attacks against financial entities in Latin America.
Its core tradecraft includes a custom title bar detection mechanism to identify targeted banking or financial websites open in a victim's browser, after which it can trigger malicious actions. Reported capabilities include credential harvesting via fake bank dialogs and full-screen overlays, keylogging, mouse and keyboard/input simulation, screenshot capture including cropped image theft, collection of system metadata, monitoring of user activity and inactivity, command execution via cmd.exe and PowerShell, forced shutdown, Task Manager manipulation, anti-fraud software detection, sandbox or anti-analysis checks, and command-and-control communications for data exfiltration. The content also states that some variants support live banking session hijacking, not just credential theft.
Observed delivery and installation chains have evolved over time. Earlier campaigns used phishing emails and ZIP archives containing VBScript files that downloaded additional ZIP archives with a legitimate executable and malicious DLL, culminating in DLL side-loading. More recent campaigns shifted to rogue MSI installers, including samples masquerading as legitimate software and distributed from platforms such as GitLab. The MSI-based chains used scripts written in Go, PowerShell, and batch, unpacked components including the RAT executable and in some cases a malicious Chromium-based browser extension, and established persistence through Windows Startup folder artifacts such as LNK shortcuts or command scripts. The malicious extension was reported to collect system information, cookies, browsing history, installed extensions, and tab metadata, and to trigger actions based on URL pattern matches.
The malware communicates with C2 infrastructure over TCP sockets and, in some reporting, periodic HTTP beaconing. One described variant rotated C2 domains daily using dynamic DNS-derived naming and used port 443 without TLS protection. Reported indicators of compromise in the provided content include the domain ciderurginsx.com and the MD5 hashes 808c87015194c51d74356854dfb10d9e and d7a68749635604d6d7297e4fa2530eb6. Kaspersky telemetry cited in the content recorded 14,739 JanelaRAT-related attacks in Brazil and 11,695 in Mexico in 2025. No specific threat actor attribution is provided in the content beyond financially motivated operators continuously refining the infection chain and malware features.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
33 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniques
Initial Access
The latest attack chain documented by Kaspersky shows that phishing emails disguised as outstanding invoices are used to trick recipients into downloading a PDF file by clicking on a link, resulting in the download of a ZIP archive...
Execution
6 techniques
Execution
Upon execution, the installer initiates a multi-stage infection process using orchestrating scripts written in Go, PowerShell, and batch...
Upon execution, the installer initiates a multi-stage infection process using orchestrating scripts written in Go, PowerShell, and batch...
Some of the supported commands include ... Running commands using "cmd.exe" and PowerShell commands or scripts
First detected in the wild by Zscaler in June 2023, JanelaRAT has leveraged ZIP archives containing a Visual Basic Script (VBScript) to download a second ZIP file...
Persistence
3 techniques
Persistence
These scripts unpack a ZIP archive containing the RAT executable, a malicious Chromium-based browser extension, and supporting components.
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
4 techniques
Stealth
The MSI file acts as an initial dropper designed to install the final implant and establish persistence on the system. It obfuscates file paths and names with the objective to hinder analysis.
...distributed via rogue MSI installer files masquerading as legitimate software hosted on trusted platforms like GitLab.
Credential Access
5 techniques
Credential Access
Some of the supported commands include ... Simulating keyboard actions like DOWN, UP, and TAB for navigation Moving the cursor and simulating clicks | ...displaying images in full-screen mode ... and impersonating bank-themed dialogs via fake overlays to harvest credentials
Its capabilities include logging keystrokes, capturing screenshots, and collecting system metadata.
This channel is used to execute malicious tasks, including taking screenshots, monitoring keyboard and mouse input...
Discovery
5 techniques
Discovery
Unlike BX RAT, it uses a custom title bar detection method to identify specific websites in a victim’s browser.
The malware collects system information, including OS version, processor architecture (32-bit, 64-bit, or unknown), username, and machine name.
Its capabilities include logging keystrokes, capturing screenshots, and collecting system metadata.
Collection
6 techniques
Collection
Some of the supported commands include ... Simulating keyboard actions like DOWN, UP, and TAB for navigation Moving the cursor and simulating clicks | ...displaying images in full-screen mode ... and impersonating bank-themed dialogs via fake overlays to harvest credentials
Its capabilities include logging keystrokes, capturing screenshots, and collecting system metadata.
This channel is used to execute malicious tasks, including taking screenshots, monitoring keyboard and mouse input...
This channel is used to execute malicious tasks, including... injecting keystrokes or simulating mouse input...
Command and Control
4 techniques
Command and Control
It communicates with command-and-control servers to exfiltrate data, impersonates bank dialogs for credential harvesting, and monitors user activity to time malicious operations.
It triggers two subroutines responsible for periodic HTTP beaconing and downloading additional payloads.
Unlike other versions, this variant rotates its C2 server daily. Once a title bar matches the one in the list, the software dynamically constructs the C2 channel domain by concatenating an obfuscated string, the current date, and a suffix domain related to a legitimate dynamic DNS (DDNS) service.
Exfiltration
1 technique
Exfiltration
IOCs tracked for this family
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malware family targeting financial and cryptocurrency data from selected banks and institutions in Latin America. It is described as a modified version of BX RAT and uses a custom title bar detection method to identify specific websites in a victim’s browser.
A modified BX RAT variant targeting financial institutions, designed to steal financial and cryptocurrency data. It uses title bar detection to target financial websites, logs keystrokes, captures screenshots, collects system metadata, uses DLL side-loading for installation, persists via Windows Startup folders, communicates with C2 servers for data exfiltration, impersonates bank dialogs for credential harvesting, and can evade anti-fraud systems and sandbox environments.
A remote access trojan targeting financial institutions and users in Latin America. It steals financial and cryptocurrency data, monitors user activity, captures screenshots and keystrokes, communicates with C2 servers, deploys fake overlays to harvest credentials, manipulates browser behavior via a malicious extension, and supports remote control actions such as command execution, cursor movement, and shutdown.
A Latin America-focused banking malware/RAT that targets financial and cryptocurrency users, especially in Brazil and Mexico. It monitors active banking sessions via window-title matching, communicates with C2 over TCP/HTTP, supports screenshots, keylogging, command execution, input simulation, overlays for credential and MFA theft, persistence, anti-analysis checks, and live banking session hijacking.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.