How to remove Grandoreiro trojan

What is Grandoreiro trojan

Grandoreiro Trojan is a sophisticated banking malware that has been actively targeting users primarily in Latin America and, more recently, in Europe. Originating from Brazil, this malware has evolved over the years, showcasing the adaptability and persistence of cybercriminals in exploiting financial systems globally. It is a banking Trojan written in Delphi, first observed in 2016. It operates under a Malware-as-a-Service (MaaS) business model, allowing it to be distributed and used by various cybercriminal groups. This malware is known for its capabilities to steal banking information, perform fraudulent transactions, and execute a range of malicious activities on infected computers. To remove Grandoreiro from an infected system, a comprehensive approach involving the uninstallation of malicious programs, resetting browsers to default settings, and using specialized malware removal tools like Malwarebytes and Spyhuner is recommended. Preventive measures include maintaining cybersecurity awareness, avoiding clicking on suspicious links or downloading attachments from unknown emails, and keeping security software up to date.

How Grandoreiro trojan infected your system

Grandoreiro employs a multi-stage infection process that typically begins with spear-phishing emails written in Spanish, targeting victims in Mexico and Spain. These emails contain embedded links that redirect the victim to a website, which then downloads a ZIP archive. The archive contains a malicious executable disguised as a benign file, which, when executed, initiates the malware’s installation process. The malware uses various anti-analysis techniques, such as binary padding with BMP images to inflate the file size and evade detection by sandboxes. It also employs a Domain Generation Algorithm (DGA) for command and control (C2) communication, making it challenging to block its communication channels.

1. Download Grandoreiro trojan Removal Tool
2. Use Windows Malicious Software Removal Tool to remove Grandoreiro trojan
3. Use Autoruns to remove Grandoreiro trojan
4. Files, folders and registry keys of Grandoreiro trojan
5. Other aliases of Grandoreiro trojan
6. How to protect from threats, like Grandoreiro trojan

Remove Grandoreiro trojan manually

Manual removal of Grandoreiro trojan by inexperienced users may become a difficult task because it does not create entries in Add/Remove Programs under Control Panel, does not install browser extensions, and uses random file names. However, there are pre-installed instruments in the Windows system, that allow you to detect and remove malware without using third-party applications. One of them is Windows Malicious Software Removal Tool. It comes with Windows Update in Windows 11, 10, 8. 8.1. For older operating system you can download it here: 64-bit version | 32-bit version.

Remove Grandoreiro trojan using Windows Malicious Software Removal Tool

1. Type mrt in the search box near Start Menu.
2. Run mrt clicking on found item.
3. Click Next button.
4. Choose one of the scan modes Quick scan, Full scan, Customize scan (Full scan recommended).
5. Click Next button.
6. Click on View detailed results of the scan link to view the scan details.
7. Click Finish button.

Remove Grandoreiro trojan using Autoruns

Grandoreiro trojan often sets up to run at Windows startup as an Autorun entry or Scheduled task.

1. Download Autoruns using this link.
2. Extract the archive and run Autoruns.exe file.
3. In Options menu make sure there are checkboxes near Hide Empty Locations, Hide Microsoft Entries, and Hide Windows Entries.
4. Search for suspicious entries with weird names or running from locations like: C:\{username}\AppData\Roaming.
5. Right-click on suspicious entry and choose Delete. This will prevent the threat to run at startup.
6. Switch to Scheduled Tasks tab and do the same.
7. To remove files themselves, click on suspicious entries and choose Jump to Entry…. Remove files or registry keys found.

Remove files, folder and registry keys of Grandoreiro trojan

Grandoreiro trojan files and folders


{randomname}.exe


Grandoreiro trojan registry keys


no information


Aliases of Grandoreiro trojan

How to protect from threats, like Grandoreiro trojan, in future

Standard Windows protection or any decent third-party antivirus (Norton, Avast, Kaspersky) should be able to detect and remove Grandoreiro trojan. However, if you got infected with Grandoreiro trojan with existing and updated security software, you may consider changing it. To feel safe and protect your PC from Grandoreiro trojan on all levels (browser, e-mail attachments, Word or Excel scripts, file system) we recommend a leading provider of internet security solutions – BitDefender. Its solutions both for home and business users proved to be one of the most advanced and effective. Choose and get your BitDefender protection via the button below:

Download BitDefender