---
title: Hunt: Casbaneiro banking trojan plus a side-loaded Chromium extension ("Painel Gangster"), delivered via an abused RMM trial tenant | ctxsec
url: https://ctxsec.com/items/hunt-casbaneiro-chromium-ext
description: ""
status: "hunt idea"
published: 2026-10-13
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-casbaneiro-chromium-ext.md)

hunt idea

2026-10-13

### Hunt: Casbaneiro banking trojan plus a side-loaded Chromium extension ("Painel Gangster"), delivered via an abused RMM trial tenant

Unit 42 TTI (Oct 13): a phishing email gets the victim to install a client for an attacker-registered _trial tenant_ of a legitimate RMM product. Operators then use PowerShell to fetch (1) a signed Caphyon Advanced Installer `VmLauncher.exe` that side-loads a Delphi DLL renamed `zlibai.dll` (decoy zlib exports, entry-point patching, XOR-encrypted command strings) and (2) an unpacked MV3 extension loaded via the browser command line. The extension has no update URL and requests cookies, scripting, tabs and webNavigation on all URLs. It reads its WebSocket C2 from a dead-drop text file and captures form fields (passwords unconditionally), cookies and screenshots, and injects HTML overlays. Targets are about 65 Portuguese/Brazilian banks plus 11 crypto exchanges. Key IOCs: `n1.youconnectedssl[.]digital/pt.txt`, `euromasterx[.]com`, `xdrivewin[.]com`, `216.203.21[.]119`, `190.2.184[.]201`.

```
// KQL sketch (MDE): signed host loading fake zlib, browsers with --load-extension
DeviceImageLoadEvents
| where InitiatingProcessFileName =~ "VmLauncher.exe" and FileName =~ "zlibai.dll"
| union (DeviceProcessEvents
  | where FileName in~ ("chrome.exe","msedge.exe","brave.exe")
  | where ProcessCommandLine has "--load-extension"
  | where InitiatingProcessFileName in~ ("powershell.exe","pwsh.exe","cmd.exe"))
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName
```

Sources: [Unit 42 TTI (GitHub)](https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-13-Casbaneiro-Banking-Trojan.txt)