www.forcepoint.com
Open in
urlscan Pro
2a04:4e42:200::740
Public Scan
URL:
https://www.forcepoint.com/blog/x-labs/exploring-metamorfo-banking-malware
Submission: On May 17 via api from TR — Scanned from DE
Submission: On May 17 via api from TR — Scanned from DE
Form analysis
4 forms found in the DOMPOST /blog/x-labs/exploring-metamorfo-banking-malware
<form class="lang_dropdown_form language_content featureWsQuerystringTranslations-processed" id="lang_dropdown_form_language_content" action="/blog/x-labs/exploring-metamorfo-banking-malware" method="post" accept-charset="UTF-8">
<div>
<div class="form-item form-type-select form-item-lang-dropdown-select">
<div class="hidden-on-desktop mobile-language has-subnav events-mobile-list-processed"><span class="subnav-header nolink"><span class="link-text-wrapper">EN - English</span></span>
<div class="subnav dropdown menu"><span class="subnav-back">EN - English</span>
<ul class="language-list" id="lang-dropdown-select-language_content" name="lang_dropdown_select">
<li value="en" class="selected">EN - English</li>
<li value="es">ES - Español (América Latina)</li>
<li value="fr">FR - Français</li>
<li value="de">DE - Deutsch</li>
<li value="it">IT - Italiano</li>
<li value="pt-br">PT-BR - Português</li>
<li value="zh-hans">ZH-HANS - 简体中文</li>
<li value="zh-hant">ZH-HANT - 繁體中文</li>
<li value="ja">JA - 日本語</li>
<li value="ko">KO - 한국어</li>
<li value="tr">TR - Türkçe</li>
<li value="ar">AR - العربية</li>
</ul>
</div><span class="subnav-trigger"></span>
</div><select class="lang-dropdown-select-element form-select chosen-processed build-mobile-list-processed" id="lang-dropdown-select-language_content" style="width: 148px; display: none;" name="lang_dropdown_select">
<option value="en" selected="selected">EN - English</option>
<option value="es">ES - Español (América Latina)</option>
<option value="fr">FR - Français</option>
<option value="de">DE - Deutsch</option>
<option value="it">IT - Italiano</option>
<option value="pt-br">PT-BR - Português</option>
<option value="zh-hans">ZH-HANS - 简体中文</option>
<option value="zh-hant">ZH-HANT - 繁體中文</option>
<option value="ja">JA - 日本語</option>
<option value="ko">KO - 한국어</option>
<option value="tr">TR - Türkçe</option>
<option value="ar">AR - العربية</option>
</select>
<div class="chosen-container chosen-container-single lang-dropdown-select-element form-select chosen-processed chosen-container-single-nosearch" style="width: 200px;" title="" id="lang_dropdown_select_language_content_chosen">
<a class="chosen-single" tabindex="-1"><span>EN - English</span><div><b></b></div></a>
<div class="chosen-drop">
<div class="chosen-search"><input type="text" autocomplete="off" readonly=""></div>
<ul class="chosen-results"></ul>
</div>
</div>
</div>
<input type="hidden" name="en" value="/blog/x-labs/exploring-metamorfo-banking-malware">
<input type="hidden" name="es" value="/es/blog/x-labs/exploring-metamorfo-banking-malware">
<input type="hidden" name="fr" value="/fr/blog/x-labs/exploring-metamorfo-banking-malware">
<input type="hidden" name="de" value="/de/blog/x-labs/exploring-metamorfo-banking-malware">
<input type="hidden" name="it" value="/it/blog/x-labs/exploring-metamorfo-banking-malware">
<input type="hidden" name="pt-br" value="/pt-br/blog/x-labs/exploring-metamorfo-banking-malware">
<input type="hidden" name="zh-hans" value="/zh-hans/blog/x-labs/exploring-metamorfo-banking-malware">
<input type="hidden" name="zh-hant" value="/zh-hant/blog/x-labs/exploring-metamorfo-banking-malware">
<input type="hidden" name="ja" value="/ja/blog/x-labs/exploring-metamorfo-banking-malware">
<input type="hidden" name="ko" value="/ko/blog/x-labs/exploring-metamorfo-banking-malware">
<input type="hidden" name="tr" value="/tr/blog/x-labs/exploring-metamorfo-banking-malware">
<input type="hidden" name="ar" value="/ar/blog/x-labs/exploring-metamorfo-banking-malware">
<noscript>
<div>
<input type="submit" id="edit-submit" name="op" value="Go" class="form-submit">
</div>
</noscript><input type="hidden" name="form_build_id" value="form-ojP-2HtDzdbVQfPEFZUvZA7RTZtqxhkSug5Q4nDeHVc">
<input type="hidden" name="form_id" value="lang_dropdown_form">
</div>
</form>
GET /search
<form action="/search" method="get" id="views-exposed-form-site-search-page" accept-charset="UTF-8">
<div>
<div class="views-exposed-form">
<div class="views-exposed-widgets clearfix">
<div id="edit-keys-wrapper" class="views-exposed-widget views-widget-filter-search_api_views_fulltext">
<label for="edit-keys"> Enter your keywords </label>
<div class="views-widget">
<div class="form-item form-type-textfield form-item-keys">
<input placeholder="Search" type="text" id="edit-keys" name="keys" value="" size="30" maxlength="128" class="form-text">
</div>
</div>
</div>
<div id="edit-type-wrapper" class="views-exposed-widget views-widget-filter-type">
<label for="edit-type"> Is Type </label>
<div class="views-widget">
<div class="form-item form-type-hidden form-item-type">
<input type="hidden" name="type" value="All">
</div>
</div>
</div>
<div class="views-exposed-widget views-submit-button">
<input type="submit" id="edit-submit-site-search" value="Search" class="form-submit">
</div>
</div>
</div>
</div>
</form>
POST https://forms.hsforms.com/submissions/v3/public/submit/formsnext/multipart/20987017/16d5bf15-75bb-43be-a7ff-4e4e9779520e
<form id="hsForm_16d5bf15-75bb-43be-a7ff-4e4e9779520e" method="POST" accept-charset="UTF-8" enctype="multipart/form-data" novalidate=""
action="https://forms.hsforms.com/submissions/v3/public/submit/formsnext/multipart/20987017/16d5bf15-75bb-43be-a7ff-4e4e9779520e"
class="hs-form-private hsForm_16d5bf15-75bb-43be-a7ff-4e4e9779520e hs-form-16d5bf15-75bb-43be-a7ff-4e4e9779520e hs-form-16d5bf15-75bb-43be-a7ff-4e4e9779520e_d32b3261-55a1-413a-83b2-c7db649b5260 hs-form stacked"
target="target_iframe_16d5bf15-75bb-43be-a7ff-4e4e9779520e" data-instance-id="d32b3261-55a1-413a-83b2-c7db649b5260" data-form-id="16d5bf15-75bb-43be-a7ff-4e4e9779520e" data-portal-id="20987017"
data-test-id="hsForm_16d5bf15-75bb-43be-a7ff-4e4e9779520e">
<div class="hs_conversion_prod_interest___most_recent hs-conversion_prod_interest___most_recent hs-fieldtype-text field hs-form-field" style="display: none;"><label
id="label-conversion_prod_interest___most_recent-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Conversion Prod Interest - Most Recent"
for="conversion_prod_interest___most_recent-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Conversion Prod Interest - Most Recent</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="conversion_prod_interest___most_recent" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_sfcmpid hs-sfcmpid hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-sfcmpid-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your sfcmpid"
for="sfcmpid-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>sfcmpid</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="sfcmpid" class="hs-input" type="hidden" value="7016T000002HlhQQAS"></div>
</div>
<div class="hs_sf_source_campaign_id hs-sf_source_campaign_id hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-sf_source_campaign_id-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class=""
placeholder="Enter your SF Source Campaign ID" for="sf_source_campaign_id-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>SF Source Campaign ID</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="sf_source_campaign_id" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_salesforce_campaign_name hs-salesforce_campaign_name hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-salesforce_campaign_name-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class=""
placeholder="Enter your Salesforce Campaign Name" for="salesforce_campaign_name-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Salesforce Campaign Name</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="salesforce_campaign_name" class="hs-input" type="hidden" value="WW.BRN.WEBS.X-Labs_Newsletter_Sign_Up.Ever"></div>
</div>
<div class="hs_core_non_core hs-core_non_core hs-fieldtype-select field hs-form-field" style="display: none;"><label id="label-core_non_core-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Core/Non-core"
for="core_non_core-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Core/Non-core</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="core_non_core" class="hs-input" type="hidden" value="Non-core"></div>
</div>
<div class="hs_gclid hs-gclid hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-gclid-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your GCLID - DO NOT USE"
for="gclid-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>GCLID - DO NOT USE</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="gclid" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_email_opt_in_security_research__c hs-email_opt_in_security_research__c hs-fieldtype-booleancheckbox field hs-form-field" style="display: none;">
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="email_opt_in_security_research__c" class="hs-input" type="hidden" value="true"></div>
</div>
<div class="hs_email hs-email hs-fieldtype-text field hs-form-field"><label id="label-email-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Work Email" for="email-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Work
Email</span><span class="hs-form-required">*</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input id="email-16d5bf15-75bb-43be-a7ff-4e4e9779520e" name="email" required="" placeholder="Email Address" type="email" class="hs-input" inputmode="email" autocomplete="email" value=""></div>
</div>
<div class="hs-dependent-field">
<div class="hs_country__c hs-country__c hs-fieldtype-select field hs-form-field smart-field"><label id="label-country__c-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Country Picklist"
for="country__c-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Country Picklist</span><span class="hs-form-required">*</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><select id="country__c-16d5bf15-75bb-43be-a7ff-4e4e9779520e" required="" class="hs-input" name="country__c">
<option disabled="" value="">Select Country</option>
<option value="Afghanistan">Afghanistan</option>
<option value="Aland Islands">Aland Islands</option>
<option value="Albania">Albania</option>
<option value="Algeria">Algeria</option>
<option value="Andorra">Andorra</option>
<option value="Angola">Angola</option>
<option value="Anguilla">Anguilla</option>
<option value="Antarctica">Antarctica</option>
<option value="Antigua and Barbuda">Antigua and Barbuda</option>
<option value="Argentina">Argentina</option>
<option value="Armenia">Armenia</option>
<option value="Aruba">Aruba</option>
<option value="Australia">Australia</option>
<option value="Austria">Austria</option>
<option value="Azerbaijan">Azerbaijan</option>
<option value="Bahamas">Bahamas</option>
<option value="Bahrain">Bahrain</option>
<option value="Bangladesh">Bangladesh</option>
<option value="Barbados">Barbados</option>
<option value="Belarus">Belarus</option>
<option value="Belgium">Belgium</option>
<option value="Belize">Belize</option>
<option value="Benin">Benin</option>
<option value="Bermuda">Bermuda</option>
<option value="Bhutan">Bhutan</option>
<option value="Bolivia, Plurinational State of">Bolivia, Plurinational State of</option>
<option value="Bonaire, Sint Eustatius and Saba">Bonaire, Sint Eustatius and Saba</option>
<option value="Bosnia and Herzegovina">Bosnia and Herzegovina</option>
<option value="Botswana">Botswana</option>
<option value="Bouvet Island">Bouvet Island</option>
<option value="Brazil">Brazil</option>
<option value="British Indian Ocean Territory">British Indian Ocean Territory</option>
<option value="Brunei Darussalam">Brunei Darussalam</option>
<option value="Bulgaria">Bulgaria</option>
<option value="Burkina Faso">Burkina Faso</option>
<option value="Burundi">Burundi</option>
<option value="Cambodia">Cambodia</option>
<option value="Cameroon">Cameroon</option>
<option value="Canada">Canada</option>
<option value="Cape Verde">Cape Verde</option>
<option value="Cayman Islands">Cayman Islands</option>
<option value="Central African Republic">Central African Republic</option>
<option value="Chad">Chad</option>
<option value="Chile">Chile</option>
<option value="China">China</option>
<option value="Chinese Taipei">Chinese Taipei</option>
<option value="Christmas Island">Christmas Island</option>
<option value="Cocos (Keeling) Islands">Cocos (Keeling) Islands</option>
<option value="Colombia">Colombia</option>
<option value="Comoros">Comoros</option>
<option value="Congo">Congo</option>
<option value="Congo, the Democratic Republic of the">Congo, the Democratic Republic of the</option>
<option value="Cook Islands">Cook Islands</option>
<option value="Costa Rica">Costa Rica</option>
<option value="Cote d'Ivoire">Cote d'Ivoire</option>
<option value="Croatia">Croatia</option>
<option value="Cuba">Cuba</option>
<option value="Curaçao">Curaçao</option>
<option value="Cyprus">Cyprus</option>
<option value="Czech Republic">Czech Republic</option>
<option value="Denmark">Denmark</option>
<option value="Djibouti">Djibouti</option>
<option value="Dominica">Dominica</option>
<option value="Dominican Republic">Dominican Republic</option>
<option value="Ecuador">Ecuador</option>
<option value="Egypt">Egypt</option>
<option value="El Salvador">El Salvador</option>
<option value="Equatorial Guinea">Equatorial Guinea</option>
<option value="Eritrea">Eritrea</option>
<option value="Estonia">Estonia</option>
<option value="Ethiopia">Ethiopia</option>
<option value="Falkland Islands (Malvinas)">Falkland Islands (Malvinas)</option>
<option value="Faroe Islands">Faroe Islands</option>
<option value="Fiji">Fiji</option>
<option value="Finland">Finland</option>
<option value="France">France</option>
<option value="French Guiana">French Guiana</option>
<option value="French Polynesia">French Polynesia</option>
<option value="French Southern Territories">French Southern Territories</option>
<option value="Gabon">Gabon</option>
<option value="Gambia">Gambia</option>
<option value="Georgia">Georgia</option>
<option value="Germany">Germany</option>
<option value="Ghana">Ghana</option>
<option value="Gibraltar">Gibraltar</option>
<option value="Greece">Greece</option>
<option value="Greenland">Greenland</option>
<option value="Grenada">Grenada</option>
<option value="Guadeloupe">Guadeloupe</option>
<option value="Guam">Guam</option>
<option value="Guatemala">Guatemala</option>
<option value="Guernsey">Guernsey</option>
<option value="Guinea">Guinea</option>
<option value="Guinea-Bissau">Guinea-Bissau</option>
<option value="Guyana">Guyana</option>
<option value="Haiti">Haiti</option>
<option value="Heard Island and McDonald Islands">Heard Island and McDonald Islands</option>
<option value="Holy See (Vatican City State)">Holy See (Vatican City State)</option>
<option value="Honduras">Honduras</option>
<option value="Hong Kong">Hong Kong</option>
<option value="Hungary">Hungary</option>
<option value="Iceland">Iceland</option>
<option value="India">India</option>
<option value="Indonesia">Indonesia</option>
<option value="Iran, Islamic Republic of">Iran, Islamic Republic of</option>
<option value="Iraq">Iraq</option>
<option value="Ireland">Ireland</option>
<option value="Isle of Man">Isle of Man</option>
<option value="Israel">Israel</option>
<option value="Italy">Italy</option>
<option value="Ivory Coast">Ivory Coast</option>
<option value="Jamaica">Jamaica</option>
<option value="Japan">Japan</option>
<option value="Jersey">Jersey</option>
<option value="Jordan">Jordan</option>
<option value="Kazakhstan">Kazakhstan</option>
<option value="Kenya">Kenya</option>
<option value="Kiribati">Kiribati</option>
<option value="Korea, Democratic People's Republic of">Korea, Democratic People's Republic of</option>
<option value="Korea, Republic of">Korea, Republic of</option>
<option value="Kosovo">Kosovo</option>
<option value="Kuwait">Kuwait</option>
<option value="Kyrgyzstan">Kyrgyzstan</option>
<option value="Lao People's Democratic Republic">Lao People's Democratic Republic</option>
<option value="Latvia">Latvia</option>
<option value="Lebanon">Lebanon</option>
<option value="Lesotho">Lesotho</option>
<option value="Liberia">Liberia</option>
<option value="Libyan Arab Jamahiriya">Libyan Arab Jamahiriya</option>
<option value="Liechtenstein">Liechtenstein</option>
<option value="Lithuania">Lithuania</option>
<option value="Luxembourg">Luxembourg</option>
<option value="Macao">Macao</option>
<option value="Macedonia, the former Yugoslav Republic of">Macedonia, the former Yugoslav Republic of</option>
<option value="Madagascar">Madagascar</option>
<option value="Malawi">Malawi</option>
<option value="Malaysia">Malaysia</option>
<option value="Maldives">Maldives</option>
<option value="Mali">Mali</option>
<option value="Malta">Malta</option>
<option value="Martinique">Martinique</option>
<option value="Mauritania">Mauritania</option>
<option value="Mauritius">Mauritius</option>
<option value="Mexico">Mexico</option>
<option value="Micronesia, Federated States of">Micronesia, Federated States of</option>
<option value="Moldova, Republic of">Moldova, Republic of</option>
<option value="Monaco">Monaco</option>
<option value="Mongolia">Mongolia</option>
<option value="Montenegro">Montenegro</option>
<option value="Montserrat">Montserrat</option>
<option value="Morocco">Morocco</option>
<option value="Mozambique">Mozambique</option>
<option value="Myanmar">Myanmar</option>
<option value="Namibia">Namibia</option>
<option value="Nauru">Nauru</option>
<option value="Nepal">Nepal</option>
<option value="Netherlands">Netherlands</option>
<option value="New Caledonia">New Caledonia</option>
<option value="New Zealand">New Zealand</option>
<option value="Nicaragua">Nicaragua</option>
<option value="Niger">Niger</option>
<option value="Nigeria">Nigeria</option>
<option value="Niue">Niue</option>
<option value="Norfolk Island">Norfolk Island</option>
<option value="Norway">Norway</option>
<option value="Oman">Oman</option>
<option value="Pakistan">Pakistan</option>
<option value="Palestinian Territory, occupied">Palestinian Territory, Occupied</option>
<option value="Panama">Panama</option>
<option value="Papua New Guinea">Papua New Guinea</option>
<option value="Paraguay">Paraguay</option>
<option value="Peru">Peru</option>
<option value="Philippines">Philippines</option>
<option value="Pitcairn">Pitcairn</option>
<option value="Poland">Poland</option>
<option value="Portugal">Portugal</option>
<option value="Puerto Rico">Puerto Rico</option>
<option value="Qatar">Qatar</option>
<option value="Reunion">Reunion</option>
<option value="Romania">Romania</option>
<option value="Russian Federation">Russian Federation</option>
<option value="Rwanda">Rwanda</option>
<option value="Saint Barthélemy">Saint Barthélemy</option>
<option value="Saint Helena, Ascension and Tristan da Cunha">Saint Helena, Ascension and Tristan da Cunha</option>
<option value="Saint Kitts and Nevis">Saint Kitts and Nevis</option>
<option value="Saint Lucia">Saint Lucia</option>
<option value="Saint Martin (French part)">Saint Martin (French part)</option>
<option value="Saint Pierre and Miquelon">Saint Pierre and Miquelon</option>
<option value="Saint Vincent and the Grenadines">Saint Vincent and the Grenadines</option>
<option value="Samoa">Samoa</option>
<option value="San Marino">San Marino</option>
<option value="Sao Tome and Principe">Sao Tome and Principe</option>
<option value="Saudi Arabia">Saudi Arabia</option>
<option value="Senegal">Senegal</option>
<option value="Serbia">Serbia</option>
<option value="Seychelles">Seychelles</option>
<option value="Sierra Leone">Sierra Leone</option>
<option value="Singapore">Singapore</option>
<option value="Sint Maarten (Dutch part)">Sint Maarten (Dutch part)</option>
<option value="Slovenia">Slovenia</option>
<option value="Solomon Islands">Solomon Islands</option>
<option value="Somalia">Somalia</option>
<option value="South Africa">South Africa</option>
<option value="South Georgia and the South Sandwich Islands">South Georgia and the South Sandwich Islands</option>
<option value="South Sudan">South Sudan</option>
<option value="Spain">Spain</option>
<option value="Sri Lanka">Sri Lanka</option>
<option value="Sudan">Sudan</option>
<option value="Suriname">Suriname</option>
<option value="Svalbard and Jan Mayen">Svalbard and Jan Mayen</option>
<option value="Swaziland">Swaziland</option>
<option value="Sweden">Sweden</option>
<option value="Switzerland">Switzerland</option>
<option value="Syrian Arab Republic">Syrian Arab Republic</option>
<option value="Taiwan">Taiwan</option>
<option value="Tajikistan">Tajikistan</option>
<option value="Tanzania, United Republic of">Tanzania, United Republic of</option>
<option value="Thailand">Thailand</option>
<option value="Timor-Leste">Timor-Leste</option>
<option value="Togo">Togo</option>
<option value="Tokelau">Tokelau</option>
<option value="Tonga">Tonga</option>
<option value="Trinidad and Tobago">Trinidad and Tobago</option>
<option value="Tunisia">Tunisia</option>
<option value="Turkey">Turkey</option>
<option value="Turkmenistan">Turkmenistan</option>
<option value="Turks and Caicos Islands">Turks and Caicos Islands</option>
<option value="Tuvalu">Tuvalu</option>
<option value="Uganda">Uganda</option>
<option value="Ukraine">Ukraine</option>
<option value="United Arab Emirates">United Arab Emirates</option>
<option value="United Kingdom">United Kingdom</option>
<option value="United States">United States</option>
<option value="Uruguay">Uruguay</option>
<option value="Uzbekistan">Uzbekistan</option>
<option value="Vanuatu">Vanuatu</option>
<option value="Viet Nam">Viet Nam</option>
<option value="Virgin Islands, British">Virgin Islands, British</option>
<option value="Virgin Islands, U.S.">Virgin Islands, U.S.</option>
<option value="Wallis and Futuna">Wallis and Futuna</option>
<option value="Western Sahara">Western Sahara</option>
<option value="Yemen">Yemen</option>
<option value="Zambia">Zambia</option>
<option value="Zimbabwe">Zimbabwe</option>
<option value="Slovakia">Slovakia</option>
<option value="Venezuela, Bolivarian Republic of">Venezuela, Bolivarian Republic of</option>
</select></div>
</div>
</div>
<div>
<div class="hs-richtext hs-main-font-element">
<p style="font-size: 12px;">By submitting this form, you agree to our <a href="https://www.forcepoint.com/legal/website-terms-and-conditions">terms</a> and to receiving communications from Forcepoint, you acknowledge our
<a href="https://www.forcepoint.com/company/privacy-policy">privacy policy</a> and you consent to the processing of your data. You can <a href="https://www.forcepoint.com/email-communication-preference-center">unsubscribe</a> at any time.</p>
</div>
</div>
<div class="hs_conversion_type hs-conversion_type hs-fieldtype-select field hs-form-field" style="display: none;"><label id="label-conversion_type-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Conversion Type"
for="conversion_type-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Conversion Type</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="conversion_type" class="hs-input" type="hidden" value="Newsletter Sign-Up"></div>
</div>
<div class="hs_submit hs-submit">
<div class="hs-field-desc" style="display: none;"></div>
<div class="actions"><input type="submit" class="hs-button primary large" value="Sign Up"></div>
</div><input name="hs_context" type="hidden"
value="{"embedAtTimestamp":"1715911742549","formDefinitionUpdatedAt":"1713365382354","lang":"en","embedType":"REGULAR","clonedFromForm":"c5d286e0-e74d-4914-95cd-1df5fc073545","renderRawHtml":"true","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36","pageTitle":"Exploring the Metamorfo Banking Trojan","pageUrl":"https://www.forcepoint.com/blog/x-labs/exploring-metamorfo-banking-malware","isHubSpotCmsGeneratedPage":false,"formTarget":"#form-nid-38032-6646b516c93cd","boolCheckBoxFields":"email_opt_in_security_research__c","rumScriptExecuteTime":526.7999992370605,"rumTotalRequestTime":757.7999992370605,"rumTotalRenderTime":807,"rumServiceResponseTime":231,"rumFormRenderTime":49.20000076293945,"connectionType":"4g","firstContentfulPaint":0,"largestContentfulPaint":0,"locale":"en","timestamp":1715911743776,"originalEmbedContext":{"portalId":"20987017","formId":"16d5bf15-75bb-43be-a7ff-4e4e9779520e","region":"na1","target":"#form-nid-38032-6646b516c93cd","isBuilder":false,"isTestPage":false,"isPreview":false,"redirectUrl":"https://www.forcepoint.com/thank-you-signing-our-newsletter","locale":"en","isMobileResponsive":true},"correlationId":"d32b3261-55a1-413a-83b2-c7db649b5260","renderedFieldsIds":["conversion_prod_interest___most_recent","sfcmpid","sf_source_campaign_id","salesforce_campaign_name","core_non_core","gclid","email_opt_in_security_research__c","email","country__c","conversion_type"],"captchaStatus":"NOT_APPLICABLE","emailResubscribeStatus":"NOT_APPLICABLE","isInsideCrossOriginFrame":false,"source":"forms-embed-1.5064","sourceName":"forms-embed","sourceVersion":"1.5064","sourceVersionMajor":"1","sourceVersionMinor":"5064","allPageIds":{},"_debug_embedLogLines":[{"clientTimestamp":1715911742621,"level":"INFO","message":"Retrieved customer callbacks used on embed context: [\"onFormReady\",\"onFormSubmit\"]"},{"clientTimestamp":1715911742622,"level":"INFO","message":"Retrieved pageContext values which may be overriden by the embed context: {\"pageTitle\":\"Exploring the Metamorfo Banking Trojan\",\"pageUrl\":\"https://www.forcepoint.com/blog/x-labs/exploring-metamorfo-banking-malware\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36\",\"isHubSpotCmsGeneratedPage\":false}"},{"clientTimestamp":1715911742624,"level":"INFO","message":"Retrieved countryCode property from normalized embed definition response: \"DE\""}]}"><iframe
name="target_iframe_16d5bf15-75bb-43be-a7ff-4e4e9779520e" style="display: none;"></iframe>
</form>
POST https://forms.hsforms.com/submissions/v3/public/submit/formsnext/multipart/20987017/16d5bf15-75bb-43be-a7ff-4e4e9779520e
<form id="hsForm_16d5bf15-75bb-43be-a7ff-4e4e9779520e" method="POST" accept-charset="UTF-8" enctype="multipart/form-data" novalidate=""
action="https://forms.hsforms.com/submissions/v3/public/submit/formsnext/multipart/20987017/16d5bf15-75bb-43be-a7ff-4e4e9779520e"
class="hs-form-private hsForm_16d5bf15-75bb-43be-a7ff-4e4e9779520e hs-form-16d5bf15-75bb-43be-a7ff-4e4e9779520e hs-form-16d5bf15-75bb-43be-a7ff-4e4e9779520e_c36952a4-ac13-488f-810c-084ca82164e5 hs-form stacked"
target="target_iframe_16d5bf15-75bb-43be-a7ff-4e4e9779520e" data-instance-id="c36952a4-ac13-488f-810c-084ca82164e5" data-form-id="16d5bf15-75bb-43be-a7ff-4e4e9779520e" data-portal-id="20987017"
data-test-id="hsForm_16d5bf15-75bb-43be-a7ff-4e4e9779520e">
<div class="hs_conversion_prod_interest___most_recent hs-conversion_prod_interest___most_recent hs-fieldtype-text field hs-form-field" style="display: none;"><label
id="label-conversion_prod_interest___most_recent-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Conversion Prod Interest - Most Recent"
for="conversion_prod_interest___most_recent-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Conversion Prod Interest - Most Recent</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="conversion_prod_interest___most_recent" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_sfcmpid hs-sfcmpid hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-sfcmpid-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your sfcmpid"
for="sfcmpid-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>sfcmpid</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="sfcmpid" class="hs-input" type="hidden" value="7016T000002HlhQQAS"></div>
</div>
<div class="hs_sf_source_campaign_id hs-sf_source_campaign_id hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-sf_source_campaign_id-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class=""
placeholder="Enter your SF Source Campaign ID" for="sf_source_campaign_id-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>SF Source Campaign ID</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="sf_source_campaign_id" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_salesforce_campaign_name hs-salesforce_campaign_name hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-salesforce_campaign_name-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class=""
placeholder="Enter your Salesforce Campaign Name" for="salesforce_campaign_name-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Salesforce Campaign Name</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="salesforce_campaign_name" class="hs-input" type="hidden" value="WW.BRN.WEBS.X-Labs_Newsletter_Sign_Up.Ever"></div>
</div>
<div class="hs_core_non_core hs-core_non_core hs-fieldtype-select field hs-form-field" style="display: none;"><label id="label-core_non_core-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Core/Non-core"
for="core_non_core-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Core/Non-core</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="core_non_core" class="hs-input" type="hidden" value="Non-core"></div>
</div>
<div class="hs_gclid hs-gclid hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-gclid-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your GCLID - DO NOT USE"
for="gclid-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>GCLID - DO NOT USE</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="gclid" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_email_opt_in_security_research__c hs-email_opt_in_security_research__c hs-fieldtype-booleancheckbox field hs-form-field" style="display: none;">
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="email_opt_in_security_research__c" class="hs-input" type="hidden" value="true"></div>
</div>
<div class="hs_email hs-email hs-fieldtype-text field hs-form-field"><label id="label-email-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Work Email" for="email-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Work
Email</span><span class="hs-form-required">*</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input id="email-16d5bf15-75bb-43be-a7ff-4e4e9779520e" name="email" required="" placeholder="Email Address" type="email" class="hs-input" inputmode="email" autocomplete="email" value=""></div>
</div>
<div class="hs-dependent-field">
<div class="hs_country__c hs-country__c hs-fieldtype-select field hs-form-field smart-field" style="display: none;"><label id="label-country__c-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Country Picklist"
for="country__c-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Country Picklist</span><span class="hs-form-required">*</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><select id="country__c-16d5bf15-75bb-43be-a7ff-4e4e9779520e" required="" class="hs-input" name="country__c">
<option disabled="" value="">Select Country</option>
<option value="Afghanistan">Afghanistan</option>
<option value="Aland Islands">Aland Islands</option>
<option value="Albania">Albania</option>
<option value="Algeria">Algeria</option>
<option value="Andorra">Andorra</option>
<option value="Angola">Angola</option>
<option value="Anguilla">Anguilla</option>
<option value="Antarctica">Antarctica</option>
<option value="Antigua and Barbuda">Antigua and Barbuda</option>
<option value="Argentina">Argentina</option>
<option value="Armenia">Armenia</option>
<option value="Aruba">Aruba</option>
<option value="Australia">Australia</option>
<option value="Austria">Austria</option>
<option value="Azerbaijan">Azerbaijan</option>
<option value="Bahamas">Bahamas</option>
<option value="Bahrain">Bahrain</option>
<option value="Bangladesh">Bangladesh</option>
<option value="Barbados">Barbados</option>
<option value="Belarus">Belarus</option>
<option value="Belgium">Belgium</option>
<option value="Belize">Belize</option>
<option value="Benin">Benin</option>
<option value="Bermuda">Bermuda</option>
<option value="Bhutan">Bhutan</option>
<option value="Bolivia, Plurinational State of">Bolivia, Plurinational State of</option>
<option value="Bonaire, Sint Eustatius and Saba">Bonaire, Sint Eustatius and Saba</option>
<option value="Bosnia and Herzegovina">Bosnia and Herzegovina</option>
<option value="Botswana">Botswana</option>
<option value="Bouvet Island">Bouvet Island</option>
<option value="Brazil">Brazil</option>
<option value="British Indian Ocean Territory">British Indian Ocean Territory</option>
<option value="Brunei Darussalam">Brunei Darussalam</option>
<option value="Bulgaria">Bulgaria</option>
<option value="Burkina Faso">Burkina Faso</option>
<option value="Burundi">Burundi</option>
<option value="Cambodia">Cambodia</option>
<option value="Cameroon">Cameroon</option>
<option value="Canada">Canada</option>
<option value="Cape Verde">Cape Verde</option>
<option value="Cayman Islands">Cayman Islands</option>
<option value="Central African Republic">Central African Republic</option>
<option value="Chad">Chad</option>
<option value="Chile">Chile</option>
<option value="China">China</option>
<option value="Chinese Taipei">Chinese Taipei</option>
<option value="Christmas Island">Christmas Island</option>
<option value="Cocos (Keeling) Islands">Cocos (Keeling) Islands</option>
<option value="Colombia">Colombia</option>
<option value="Comoros">Comoros</option>
<option value="Congo">Congo</option>
<option value="Congo, the Democratic Republic of the">Congo, the Democratic Republic of the</option>
<option value="Cook Islands">Cook Islands</option>
<option value="Costa Rica">Costa Rica</option>
<option value="Cote d'Ivoire">Cote d'Ivoire</option>
<option value="Croatia">Croatia</option>
<option value="Cuba">Cuba</option>
<option value="Curaçao">Curaçao</option>
<option value="Cyprus">Cyprus</option>
<option value="Czech Republic">Czech Republic</option>
<option value="Denmark">Denmark</option>
<option value="Djibouti">Djibouti</option>
<option value="Dominica">Dominica</option>
<option value="Dominican Republic">Dominican Republic</option>
<option value="Ecuador">Ecuador</option>
<option value="Egypt">Egypt</option>
<option value="El Salvador">El Salvador</option>
<option value="Equatorial Guinea">Equatorial Guinea</option>
<option value="Eritrea">Eritrea</option>
<option value="Estonia">Estonia</option>
<option value="Ethiopia">Ethiopia</option>
<option value="Falkland Islands (Malvinas)">Falkland Islands (Malvinas)</option>
<option value="Faroe Islands">Faroe Islands</option>
<option value="Fiji">Fiji</option>
<option value="Finland">Finland</option>
<option value="France">France</option>
<option value="French Guiana">French Guiana</option>
<option value="French Polynesia">French Polynesia</option>
<option value="French Southern Territories">French Southern Territories</option>
<option value="Gabon">Gabon</option>
<option value="Gambia">Gambia</option>
<option value="Georgia">Georgia</option>
<option value="Germany">Germany</option>
<option value="Ghana">Ghana</option>
<option value="Gibraltar">Gibraltar</option>
<option value="Greece">Greece</option>
<option value="Greenland">Greenland</option>
<option value="Grenada">Grenada</option>
<option value="Guadeloupe">Guadeloupe</option>
<option value="Guam">Guam</option>
<option value="Guatemala">Guatemala</option>
<option value="Guernsey">Guernsey</option>
<option value="Guinea">Guinea</option>
<option value="Guinea-Bissau">Guinea-Bissau</option>
<option value="Guyana">Guyana</option>
<option value="Haiti">Haiti</option>
<option value="Heard Island and McDonald Islands">Heard Island and McDonald Islands</option>
<option value="Holy See (Vatican City State)">Holy See (Vatican City State)</option>
<option value="Honduras">Honduras</option>
<option value="Hong Kong">Hong Kong</option>
<option value="Hungary">Hungary</option>
<option value="Iceland">Iceland</option>
<option value="India">India</option>
<option value="Indonesia">Indonesia</option>
<option value="Iran, Islamic Republic of">Iran, Islamic Republic of</option>
<option value="Iraq">Iraq</option>
<option value="Ireland">Ireland</option>
<option value="Isle of Man">Isle of Man</option>
<option value="Israel">Israel</option>
<option value="Italy">Italy</option>
<option value="Ivory Coast">Ivory Coast</option>
<option value="Jamaica">Jamaica</option>
<option value="Japan">Japan</option>
<option value="Jersey">Jersey</option>
<option value="Jordan">Jordan</option>
<option value="Kazakhstan">Kazakhstan</option>
<option value="Kenya">Kenya</option>
<option value="Kiribati">Kiribati</option>
<option value="Korea, Democratic People's Republic of">Korea, Democratic People's Republic of</option>
<option value="Korea, Republic of">Korea, Republic of</option>
<option value="Kosovo">Kosovo</option>
<option value="Kuwait">Kuwait</option>
<option value="Kyrgyzstan">Kyrgyzstan</option>
<option value="Lao People's Democratic Republic">Lao People's Democratic Republic</option>
<option value="Latvia">Latvia</option>
<option value="Lebanon">Lebanon</option>
<option value="Lesotho">Lesotho</option>
<option value="Liberia">Liberia</option>
<option value="Libyan Arab Jamahiriya">Libyan Arab Jamahiriya</option>
<option value="Liechtenstein">Liechtenstein</option>
<option value="Lithuania">Lithuania</option>
<option value="Luxembourg">Luxembourg</option>
<option value="Macao">Macao</option>
<option value="Macedonia, the former Yugoslav Republic of">Macedonia, the former Yugoslav Republic of</option>
<option value="Madagascar">Madagascar</option>
<option value="Malawi">Malawi</option>
<option value="Malaysia">Malaysia</option>
<option value="Maldives">Maldives</option>
<option value="Mali">Mali</option>
<option value="Malta">Malta</option>
<option value="Martinique">Martinique</option>
<option value="Mauritania">Mauritania</option>
<option value="Mauritius">Mauritius</option>
<option value="Mexico">Mexico</option>
<option value="Micronesia, Federated States of">Micronesia, Federated States of</option>
<option value="Moldova, Republic of">Moldova, Republic of</option>
<option value="Monaco">Monaco</option>
<option value="Mongolia">Mongolia</option>
<option value="Montenegro">Montenegro</option>
<option value="Montserrat">Montserrat</option>
<option value="Morocco">Morocco</option>
<option value="Mozambique">Mozambique</option>
<option value="Myanmar">Myanmar</option>
<option value="Namibia">Namibia</option>
<option value="Nauru">Nauru</option>
<option value="Nepal">Nepal</option>
<option value="Netherlands">Netherlands</option>
<option value="New Caledonia">New Caledonia</option>
<option value="New Zealand">New Zealand</option>
<option value="Nicaragua">Nicaragua</option>
<option value="Niger">Niger</option>
<option value="Nigeria">Nigeria</option>
<option value="Niue">Niue</option>
<option value="Norfolk Island">Norfolk Island</option>
<option value="Norway">Norway</option>
<option value="Oman">Oman</option>
<option value="Pakistan">Pakistan</option>
<option value="Palestinian Territory, occupied">Palestinian Territory, Occupied</option>
<option value="Panama">Panama</option>
<option value="Papua New Guinea">Papua New Guinea</option>
<option value="Paraguay">Paraguay</option>
<option value="Peru">Peru</option>
<option value="Philippines">Philippines</option>
<option value="Pitcairn">Pitcairn</option>
<option value="Poland">Poland</option>
<option value="Portugal">Portugal</option>
<option value="Puerto Rico">Puerto Rico</option>
<option value="Qatar">Qatar</option>
<option value="Reunion">Reunion</option>
<option value="Romania">Romania</option>
<option value="Russian Federation">Russian Federation</option>
<option value="Rwanda">Rwanda</option>
<option value="Saint Barthélemy">Saint Barthélemy</option>
<option value="Saint Helena, Ascension and Tristan da Cunha">Saint Helena, Ascension and Tristan da Cunha</option>
<option value="Saint Kitts and Nevis">Saint Kitts and Nevis</option>
<option value="Saint Lucia">Saint Lucia</option>
<option value="Saint Martin (French part)">Saint Martin (French part)</option>
<option value="Saint Pierre and Miquelon">Saint Pierre and Miquelon</option>
<option value="Saint Vincent and the Grenadines">Saint Vincent and the Grenadines</option>
<option value="Samoa">Samoa</option>
<option value="San Marino">San Marino</option>
<option value="Sao Tome and Principe">Sao Tome and Principe</option>
<option value="Saudi Arabia">Saudi Arabia</option>
<option value="Senegal">Senegal</option>
<option value="Serbia">Serbia</option>
<option value="Seychelles">Seychelles</option>
<option value="Sierra Leone">Sierra Leone</option>
<option value="Singapore">Singapore</option>
<option value="Sint Maarten (Dutch part)">Sint Maarten (Dutch part)</option>
<option value="Slovenia">Slovenia</option>
<option value="Solomon Islands">Solomon Islands</option>
<option value="Somalia">Somalia</option>
<option value="South Africa">South Africa</option>
<option value="South Georgia and the South Sandwich Islands">South Georgia and the South Sandwich Islands</option>
<option value="South Sudan">South Sudan</option>
<option value="Spain">Spain</option>
<option value="Sri Lanka">Sri Lanka</option>
<option value="Sudan">Sudan</option>
<option value="Suriname">Suriname</option>
<option value="Svalbard and Jan Mayen">Svalbard and Jan Mayen</option>
<option value="Swaziland">Swaziland</option>
<option value="Sweden">Sweden</option>
<option value="Switzerland">Switzerland</option>
<option value="Syrian Arab Republic">Syrian Arab Republic</option>
<option value="Taiwan">Taiwan</option>
<option value="Tajikistan">Tajikistan</option>
<option value="Tanzania, United Republic of">Tanzania, United Republic of</option>
<option value="Thailand">Thailand</option>
<option value="Timor-Leste">Timor-Leste</option>
<option value="Togo">Togo</option>
<option value="Tokelau">Tokelau</option>
<option value="Tonga">Tonga</option>
<option value="Trinidad and Tobago">Trinidad and Tobago</option>
<option value="Tunisia">Tunisia</option>
<option value="Turkey">Turkey</option>
<option value="Turkmenistan">Turkmenistan</option>
<option value="Turks and Caicos Islands">Turks and Caicos Islands</option>
<option value="Tuvalu">Tuvalu</option>
<option value="Uganda">Uganda</option>
<option value="Ukraine">Ukraine</option>
<option value="United Arab Emirates">United Arab Emirates</option>
<option value="United Kingdom">United Kingdom</option>
<option value="United States">United States</option>
<option value="Uruguay">Uruguay</option>
<option value="Uzbekistan">Uzbekistan</option>
<option value="Vanuatu">Vanuatu</option>
<option value="Viet Nam">Viet Nam</option>
<option value="Virgin Islands, British">Virgin Islands, British</option>
<option value="Virgin Islands, U.S.">Virgin Islands, U.S.</option>
<option value="Wallis and Futuna">Wallis and Futuna</option>
<option value="Western Sahara">Western Sahara</option>
<option value="Yemen">Yemen</option>
<option value="Zambia">Zambia</option>
<option value="Zimbabwe">Zimbabwe</option>
<option value="Slovakia">Slovakia</option>
<option value="Venezuela, Bolivarian Republic of">Venezuela, Bolivarian Republic of</option>
</select></div>
</div>
</div>
<div>
<div class="hs-richtext hs-main-font-element">
<p style="font-size: 12px;">By submitting this form, you agree to our <a href="https://www.forcepoint.com/legal/website-terms-and-conditions">terms</a> and to receiving communications from Forcepoint, you acknowledge our
<a href="https://www.forcepoint.com/company/privacy-policy">privacy policy</a> and you consent to the processing of your data. You can <a href="https://www.forcepoint.com/email-communication-preference-center">unsubscribe</a> at any time.</p>
</div>
</div>
<div class="hs_conversion_type hs-conversion_type hs-fieldtype-select field hs-form-field" style="display: none;"><label id="label-conversion_type-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Conversion Type"
for="conversion_type-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Conversion Type</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="conversion_type" class="hs-input" type="hidden" value="Newsletter Sign-Up"></div>
</div>
<div class="hs_submit hs-submit">
<div class="hs-field-desc" style="display: none;"></div>
<div class="actions"><input type="submit" class="hs-button primary large" value="Sign Up"></div>
</div><input name="hs_context" type="hidden"
value="{"embedAtTimestamp":"1715911742861","formDefinitionUpdatedAt":"1713365382354","lang":"en","embedType":"REGULAR","clonedFromForm":"c5d286e0-e74d-4914-95cd-1df5fc073545","renderRawHtml":"true","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36","pageTitle":"Exploring the Metamorfo Banking Trojan","pageUrl":"https://www.forcepoint.com/blog/x-labs/exploring-metamorfo-banking-malware","isHubSpotCmsGeneratedPage":false,"formTarget":"#form-nid-27476-6646b518139c4","boolCheckBoxFields":"email_opt_in_security_research__c","rumScriptExecuteTime":526.7999992370605,"rumTotalRequestTime":1060.7999992370605,"rumTotalRenderTime":1084.1000003814697,"rumServiceResponseTime":534,"rumFormRenderTime":23.30000114440918,"connectionType":"4g","firstContentfulPaint":0,"largestContentfulPaint":0,"locale":"en","timestamp":1715911743953,"originalEmbedContext":{"portalId":"20987017","formId":"16d5bf15-75bb-43be-a7ff-4e4e9779520e","region":"na1","target":"#form-nid-27476-6646b518139c4","isBuilder":false,"isTestPage":false,"isPreview":false,"redirectUrl":"https://www.forcepoint.com/thank-you-signing-our-newsletter","locale":"en","isMobileResponsive":true},"correlationId":"c36952a4-ac13-488f-810c-084ca82164e5","renderedFieldsIds":["conversion_prod_interest___most_recent","sfcmpid","sf_source_campaign_id","salesforce_campaign_name","core_non_core","gclid","email_opt_in_security_research__c","email","country__c","conversion_type"],"captchaStatus":"NOT_APPLICABLE","emailResubscribeStatus":"NOT_APPLICABLE","isInsideCrossOriginFrame":false,"source":"forms-embed-1.5064","sourceName":"forms-embed","sourceVersion":"1.5064","sourceVersionMajor":"1","sourceVersionMinor":"5064","allPageIds":{},"_debug_embedLogLines":[{"clientTimestamp":1715911742926,"level":"INFO","message":"Retrieved customer callbacks used on embed context: [\"onFormReady\",\"onFormSubmit\"]"},{"clientTimestamp":1715911742926,"level":"INFO","message":"Retrieved pageContext values which may be overriden by the embed context: {\"pageTitle\":\"Exploring the Metamorfo Banking Trojan\",\"pageUrl\":\"https://www.forcepoint.com/blog/x-labs/exploring-metamorfo-banking-malware\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36\",\"isHubSpotCmsGeneratedPage\":false}"},{"clientTimestamp":1715911742927,"level":"INFO","message":"Retrieved countryCode property from normalized embed definition response: \"DE\""}]}"><iframe
name="target_iframe_16d5bf15-75bb-43be-a7ff-4e4e9779520e" style="display: none;"></iframe>
</form>
Text Content
Skip to main content Forcepoint * Partners Partners * Partner Login * Find a Partner * Become a Partner * Global Partner Program * Technology Partners * Find a Distributor * Services & Support Services & Support * Support Login * Professional Services * Training * Company Company * Customers * Newsroom * Work With Us * Contact Us * Forcepoint Trust Hub EN - English EN - English * EN - English * ES - Español (América Latina) * FR - Français * DE - Deutsch * IT - Italiano * PT-BR - Português * ZH-HANS - 简体中文 * ZH-HANT - 繁體中文 * JA - 日本語 * KO - 한국어 * TR - Türkçe * AR - العربية EN - EnglishES - Español (América Latina)FR - FrançaisDE - DeutschIT - ItalianoPT-BR - PortuguêsZH-HANS - 简体中文ZH-HANT - 繁體中文JA - 日本語KO - 한국어TR - TürkçeAR - العربية EN - English Enter your keywords Is Type Jump to * Why Forcepoint Why Forcepoint * group * About Us Our vision and mission * Our Approach Our data-first approach to cybersecurity * Our Customers We help people work freely, securely and with confidence * Data Security Everywhere Data Security Everywhere * group (1st row) * group (Data Security Everywhere) * Data Security Everywhere Work Anywhere with Data Everywhere. Safely. Discover How * group (Products) * group (Products 1st Row) * Featured Products * Forcepoint ONE Data Security (Cloud DLP) Prevent breaches and streamline compliance from the cloud. * Enterprise DLP Industry-leading DLP with enterprise-class accuracy and automation. * DSPM (Data Security Posture Management) Discover, classify and orchestrate with AI-powered automation. * Data Classification Increase the accuracy and efficiency of classification. * Risk Adaptive Protection Respond to risk in real-time with policy automation. * DLP for Email Prevent data exfiltration within outbound emails. * group (Products 2nd row) * Top-Rated Solutions * Unify Cloud, Endpoint and BYOD Data Protection * Automate Data Security Based on Risky Behavior * Discover and Secure Unstructured Data with AI * Classify and Protect Sensitive Data with AI * Prevent Data Theft in Outbound Emails * Protect Users and Data on the Web * group (2nd row) * Schedule a Live Demo * On-Demand Demo * Data-first SASE Data-first SASE * group (row1) * group (FP ONE) * Forcepoint ONE Simplify and Secure Access to Data Everywhere Discover How * group (products) * group (products 1st row) * Featured Products * Cloud Access Security Broker Secure data on any public cloud application. * Zero Trust Network Access Remotely access every private web app on any device. * Secure Web Gateway Safely browse the web and download files. * Remote Browser Isolation Render risky websites in a container to browse safely. * Cloud Firewall Inspect traffic and protect against threats. * Secure SD-WAN Connect and protect branches, offices and more. * group (products 2nd row) * Top-Rated Solutions * Simplify Security at the Edge * Work Safely from Anywhere * Connect and Protect Remote Offices * Enable Remote Workers * Safely Use ChatGPT and Generative AI * Secure Data in Microsoft 365 * group (row2) * Schedule a Live Demo * On-Demand Demo * Resources Resources * group (links column) * group (resource links) * Blog * Webcasts * Podcasts * Analyst Reports * Customer Stories * Resource Library * Training * -------------------------------------------------------------------------------- * group (cyber edut) * Cyber Edu Learn More * group (cta column) * group (cards) * Guide Ultimate Guide to Data Security Dive into the Guide * Video Forcepoint Data Security Posture Management Demo Watch the Video * Analyst Report Forcepoint has been named a leader in The Forrester Wave: Security Service Edge Solutions, Q1 2024 Read the Report * Podcast The Radical Transparency Opportunity in Cybersecurity Listen to the Podcast * View All Resources * Talk to an Expert Main Menu YOU ARE HERE Home:Blogs:Exploring the Metamorfo Banking Trojan X-Labs May 16, 2024 | 6 min read EXPLORING THE METAMORFO BANKING TROJAN Prashant Kumar Cybersecurity Financial Security Malware Threat Report Banking Trojans have become increasingly prevalent in recent times. Today, we’ll delve into one particular campaign. This malware, commonly known as Metamorfo, spreads through malspam campaigns, enticing users to click on HTML attachments. Once clicked, a series of activities are initiated, all focused on gathering system metadata. Metamorfo is notorious for its banking trojan capabilities and as such, it has gained considerable recognition in the cybersecurity landscape. INFECTION CHAIN: Eml -> zip -> html -> url (evasive) -> zip -> hta -> ps1 -> zip -> a3x (Encoded Script file) -> shellcode HTML contains basic obfuscation which on de-obfuscating gives the URL which the file is trying to connect. Fig 1 - Obfuscated HTML Fig 2 - Deobfuscated HTML On de-obfuscating the HTML, we get the URL which it is trying to connect. “hxxps://shorturl[.]at/cdhHJ” After we browse the URL, it gives the error “Sorry, you have been blocked” which gives us glimpse URL can be geo-evasive. Fig 3 – Access blocked Lets try to browse the URL, in some of the locations. When we try to browse the URL in Mexico location, we see the URL is getting browsed and downloads a zip file with some random {{name.zip}} Fig 4 – Geo-location and zip download The zip file contains a .hta file and an .xml file. Statically analyzing .hta file, we see some obfuscations. Fig 5 – Obfuscated HTA On De-obfuscating, we get a URL pattern, hxxps://facturacioncontable[.]com/ldvb/0105 Fig 6 – De-obfuscated HTA Browsing the above URL, it downloads a PowerShell script which is again obfuscated Fig 7 – Obfuscated PowerShell From above PowerShell script, we see mostly base64 encodings, and on decoding we can figure out the behavior statically. Fig 8.1 – Decoded base64 in Powershell Fig 8.2 – Decoded base64 in Powershell In Fig 8.2, there is one more level of obfuscation [Highlighted] which resolves to another URL (hxxps://fsnat[.]shop/A/08/150822/AU/AU) which is again a PowerShell script. Fig 8.2.1 – Obfuscated Powershell Fig 8.3 – Decoded base64 in Powershell Fig 8.4 – Decoded base64 in Powershell PowerShell behavior in brief: 1. Checking for system information, installed antiviruses, computer name, and OS versions. 2. Establishes remote sever connection and sends collected system information to compromised sites 3. Downloading files from remote server and executing malicious payloads. 4. Script creates multiple shortcuts and batch file in different locations including AppData and StartUp folder. 5. Attempts to disable or bypass security measures such as Antivirus software and disabling security services. 6. Registry modifications to add new user account with admin privileges. 7. Shuts down system after script execution is complete and re-starting the system can cause above mentioned batch files or shortcuts to persist the malware and execute it automatically. Also, PowerShell connects to “hxxps://facturacioncontable[.]com/m[.]zip“ and downloads a zip file which contains multiple files. The zip file contains AutoIt executable(clean) along with .a3x script files and some batch files which are used by above PowerShell script to gather sensitive information from compromised systems. Fig 9.1 Here the script does registry changes, modifies safeboot, adds a batch file, and shuts down system in given time range which leads to persistence. Fig 9.2 If we closely observe Fig 9.1 and Fig 9.2, we can find out relation. In Fig 9.1, the script makes registry changes and adds foi[.]bat. The script in Fig 9.2 is foi.txt and is batch file. The script in Fig 9.2 does series of activities, deletes safeboot, deletes .dll and .sys files and finally shuts down system which on re-starting leads to persistence. The PowerShell commands are utilized to drop the files at various suspicious locations, shutdown the system, and causing persistence to steal user data such as Computer Names, modifying system settings, user settings, keylogging and sending it to compromise systems. Conclusion: The Metamorfo also know as Casbaneiro is much famous banking trojan which focuses on stealing victims’ financial information including banking credentials. This malware mostly targets North and South America geo-locations. The malware is distributed via email urges user to click on the attachment. The attachment contains malicious codes which does series of activities and leads to data compromise. Protection statement Forcepoint customers are protected against this threat at the following stages of attack: * Stage 2 (Lure) – Malicious attachments associated with these attacks are identified and blocked. * Stage 3 (Redirect) - The redirection to the BlogSpot URL is categorized and blocked under security classification. * Stage 5 (Dropper File) - The dropper files are added to Forcepoint malicious database and are blocked. IOC LIST: IP addresses: * 54.39.10[.]87 * 20.206.126[.]228 * 89.116.236[.]122 * 158.69.110[.]217 * 89.117.37[.]61 * 185.185.87[.]45 * 172.105.111[.]154 * 51.38.235[.]152 * 192.46.216[.]151 * 86.38.217[.]167 * 38.54.20[.]37 * 154.223.16[.]114 * 139.177.193[.]74 * 149.100.158[.]179 * 20.92.164[.]32 * 212.46.38[.]43 * 216.238.70[.]224 * 185.45.195[.]226 * 80.211.249[.]77 * 18.184.132[.]208 Domains: vqz8[.]gotdns[.]ch nhoquemassa[.]com 09dfwss6g1v73sya[.]online cevda3jvv5oz1t37[.]online 4yw2twoy438df9qt[.]online albumdepremios[.]com[.]br chooseanother[.]com yuphsa6qwtg5[.]online 6c48ax07dy25hvu0hub[.]online z5im1ou9o480se02pro[.]online x50zbqev4po5[.]online newlife2020[.]club k6ue95v1ca2r[.]online jkue[.]myftp[.]biz 2xo0uaqv4cqds331mart[.]online zfi8ny6yi30s[.]website mpy8n37wvwu2now[.]online l155vcram2hl6ws0[.]online x6vl9710f400g7alstar[.]online baza[.]alta-bars[.]ru URLs: hxxp://86.38.217[.]167/13/index[.]php hxxp://86.38.217[.]167/ps1/index[.]php hxxp://86.38.217[.]167/ld/index[.]php hxxp://86.38.217[.]167/vth/vth hxxp://86.38.217[.]167/ps/index[.]php hxxp://adbd[.]tech/26/index[.]php hxxp://86.38.217[.]167/07/index[.]php hxxp://86.38.217[.]167/21/index[.]php hxxp://ad2.gotdns[.]ch/22/22 hxxp://38.54.20[.]37/29/index[.]php hxxp://38.54.20[.]37/nv/index[.]php hxxp://38.54.20[.]37/17/17 hxxp://a.3utilities[.]com/17/ hxxp://38.54.20[.]37/04/04 hxxp://avs.myftp[.]biz/04/ hxxp://38.54.20[.]37/19/index[.]php hxxp://38.54.20[.]37/29/29 hxxp://avs.myftp[.]biz/29/ hxxp://38.54.20[.]37/08/08 hxxp://jan.viewdns[.]net/08/ HTML hashes: 428fe9b7608cd82303e27103c3058ecd61bd58a6 bbf3387c82a600053e2fdfef6491cc20d099dd0a 5844edfe712db9ba8f50ae767089c6430cb2a3ff 7fd7c43a1237c2c4245ac987fbbac54fdad3ba06 0a590eece111062573082c248d722c428134db66 8cc2248e33c3e9521f97965706ce374530d971cb 45f8c91f0299012a8dcb40d9a2fb5ce7962b887a PowerShell hashes: a9e9df6762418bbed030e825099282da59278db0 e2218b08b6dd53fa115ad50b70f41d0f0a080ce6 .a3x file: 2bd4acea5c3bf107cc6615af65d1617c847814cc 4b5b7cf403ac7d6e3dd787104e3e6bd088743815 PRASHANT KUMAR Prashant serves as a Security Researcher for the X-Labs Threat Research Content. He spends his time researching web and email-based cyberattacks with a particular focus on URL research, email security and analyzing malware campaigns. Read more articles by Prashant Kumar ABOUT FORCEPOINT Forcepoint is the leading user and data protection cybersecurity company, entrusted to safeguard organizations while driving digital transformation and growth. Our solutions adapt in real-time to how people interact with data, providing secure access while enabling employees to create value. Learn more about Forcepoint Advanced Malware Detection IN THE ARTICLE SHARE LinkedIn Twitter Facebook FORCEPOINT | X-LABS SIGN UP FOR THE LATEST FROM OUR RESEARCH AND DEVELOPMENT TEAM Conversion Prod Interest - Most Recent sfcmpid SF Source Campaign ID Salesforce Campaign Name Core/Non-core GCLID - DO NOT USE Work Email* Country Picklist* Select CountryAfghanistanAland IslandsAlbaniaAlgeriaAndorraAngolaAnguillaAntarcticaAntigua and BarbudaArgentinaArmeniaArubaAustraliaAustriaAzerbaijanBahamasBahrainBangladeshBarbadosBelarusBelgiumBelizeBeninBermudaBhutanBolivia, Plurinational State ofBonaire, Sint Eustatius and SabaBosnia and HerzegovinaBotswanaBouvet IslandBrazilBritish Indian Ocean TerritoryBrunei DarussalamBulgariaBurkina FasoBurundiCambodiaCameroonCanadaCape VerdeCayman IslandsCentral African RepublicChadChileChinaChinese TaipeiChristmas IslandCocos (Keeling) IslandsColombiaComorosCongoCongo, the Democratic Republic of theCook IslandsCosta RicaCote d'IvoireCroatiaCubaCuraçaoCyprusCzech RepublicDenmarkDjiboutiDominicaDominican RepublicEcuadorEgyptEl SalvadorEquatorial GuineaEritreaEstoniaEthiopiaFalkland Islands (Malvinas)Faroe IslandsFijiFinlandFranceFrench GuianaFrench PolynesiaFrench Southern TerritoriesGabonGambiaGeorgiaGermanyGhanaGibraltarGreeceGreenlandGrenadaGuadeloupeGuamGuatemalaGuernseyGuineaGuinea-BissauGuyanaHaitiHeard Island and McDonald IslandsHoly See (Vatican City State)HondurasHong KongHungaryIcelandIndiaIndonesiaIran, Islamic Republic ofIraqIrelandIsle of ManIsraelItalyIvory CoastJamaicaJapanJerseyJordanKazakhstanKenyaKiribatiKorea, Democratic People's Republic ofKorea, Republic ofKosovoKuwaitKyrgyzstanLao People's Democratic RepublicLatviaLebanonLesothoLiberiaLibyan Arab JamahiriyaLiechtensteinLithuaniaLuxembourgMacaoMacedonia, the former Yugoslav Republic ofMadagascarMalawiMalaysiaMaldivesMaliMaltaMartiniqueMauritaniaMauritiusMexicoMicronesia, Federated States ofMoldova, Republic ofMonacoMongoliaMontenegroMontserratMoroccoMozambiqueMyanmarNamibiaNauruNepalNetherlandsNew CaledoniaNew ZealandNicaraguaNigerNigeriaNiueNorfolk IslandNorwayOmanPakistanPalestinian Territory, OccupiedPanamaPapua New GuineaParaguayPeruPhilippinesPitcairnPolandPortugalPuerto RicoQatarReunionRomaniaRussian FederationRwandaSaint BarthélemySaint Helena, Ascension and Tristan da CunhaSaint Kitts and NevisSaint LuciaSaint Martin (French part)Saint Pierre and MiquelonSaint Vincent and the GrenadinesSamoaSan MarinoSao Tome and PrincipeSaudi ArabiaSenegalSerbiaSeychellesSierra LeoneSingaporeSint Maarten (Dutch part)SloveniaSolomon IslandsSomaliaSouth AfricaSouth Georgia and the South Sandwich IslandsSouth SudanSpainSri LankaSudanSurinameSvalbard and Jan MayenSwazilandSwedenSwitzerlandSyrian Arab RepublicTaiwanTajikistanTanzania, United Republic ofThailandTimor-LesteTogoTokelauTongaTrinidad and TobagoTunisiaTurkeyTurkmenistanTurks and Caicos IslandsTuvaluUgandaUkraineUnited Arab EmiratesUnited KingdomUnited StatesUruguayUzbekistanVanuatuViet NamVirgin Islands, BritishVirgin Islands, U.S.Wallis and FutunaWestern SaharaYemenZambiaZimbabweSlovakiaVenezuela, Bolivarian Republic of By submitting this form, you agree to our terms and to receiving communications from Forcepoint, you acknowledge our privacy policy and you consent to the processing of your data. You can unsubscribe at any time. Conversion Type TO THE POINT CYBERSECURITY A podcast covering latest trends and topics in the world of cybersecurity Listen now MORE ARTICLES IN X-LABS X-Labs Previous FROM DOCUMENT TO SCRIPT: INSIDES OF DARKGATE'S CAMPAIGN Mayur Sewani | May 14 2024 X-Labs Previous ONLINE TRAVELERS AT RISK: AGENT TESLA MALWARE ATTACKS TRAVEL INDUSTRY Mayur Sewani Prashant Kumar | Feb 26 2024 X-Labs Exploring the Metamorfo Banking Trojan X-LABS GET INSIGHT, ANALYSIS & NEWS STRAIGHT TO YOUR INBOX Conversion Prod Interest - Most Recent sfcmpid SF Source Campaign ID Salesforce Campaign Name Core/Non-core GCLID - DO NOT USE Work Email* Country Picklist* Select CountryAfghanistanAland IslandsAlbaniaAlgeriaAndorraAngolaAnguillaAntarcticaAntigua and BarbudaArgentinaArmeniaArubaAustraliaAustriaAzerbaijanBahamasBahrainBangladeshBarbadosBelarusBelgiumBelizeBeninBermudaBhutanBolivia, Plurinational State ofBonaire, Sint Eustatius and SabaBosnia and HerzegovinaBotswanaBouvet IslandBrazilBritish Indian Ocean TerritoryBrunei DarussalamBulgariaBurkina FasoBurundiCambodiaCameroonCanadaCape VerdeCayman IslandsCentral African RepublicChadChileChinaChinese TaipeiChristmas IslandCocos (Keeling) IslandsColombiaComorosCongoCongo, the Democratic Republic of theCook IslandsCosta RicaCote d'IvoireCroatiaCubaCuraçaoCyprusCzech RepublicDenmarkDjiboutiDominicaDominican RepublicEcuadorEgyptEl SalvadorEquatorial GuineaEritreaEstoniaEthiopiaFalkland Islands (Malvinas)Faroe IslandsFijiFinlandFranceFrench GuianaFrench PolynesiaFrench Southern TerritoriesGabonGambiaGeorgiaGermanyGhanaGibraltarGreeceGreenlandGrenadaGuadeloupeGuamGuatemalaGuernseyGuineaGuinea-BissauGuyanaHaitiHeard Island and McDonald IslandsHoly See (Vatican City State)HondurasHong KongHungaryIcelandIndiaIndonesiaIran, Islamic Republic ofIraqIrelandIsle of ManIsraelItalyIvory CoastJamaicaJapanJerseyJordanKazakhstanKenyaKiribatiKorea, Democratic People's Republic ofKorea, Republic ofKosovoKuwaitKyrgyzstanLao People's Democratic RepublicLatviaLebanonLesothoLiberiaLibyan Arab JamahiriyaLiechtensteinLithuaniaLuxembourgMacaoMacedonia, the former Yugoslav Republic ofMadagascarMalawiMalaysiaMaldivesMaliMaltaMartiniqueMauritaniaMauritiusMexicoMicronesia, Federated States ofMoldova, Republic ofMonacoMongoliaMontenegroMontserratMoroccoMozambiqueMyanmarNamibiaNauruNepalNetherlandsNew CaledoniaNew ZealandNicaraguaNigerNigeriaNiueNorfolk IslandNorwayOmanPakistanPalestinian Territory, OccupiedPanamaPapua New GuineaParaguayPeruPhilippinesPitcairnPolandPortugalPuerto RicoQatarReunionRomaniaRussian FederationRwandaSaint BarthélemySaint Helena, Ascension and Tristan da CunhaSaint Kitts and NevisSaint LuciaSaint Martin (French part)Saint Pierre and MiquelonSaint Vincent and the GrenadinesSamoaSan MarinoSao Tome and PrincipeSaudi ArabiaSenegalSerbiaSeychellesSierra LeoneSingaporeSint Maarten (Dutch part)SloveniaSolomon IslandsSomaliaSouth AfricaSouth Georgia and the South Sandwich IslandsSouth SudanSpainSri LankaSudanSurinameSvalbard and Jan MayenSwazilandSwedenSwitzerlandSyrian Arab RepublicTaiwanTajikistanTanzania, United Republic ofThailandTimor-LesteTogoTokelauTongaTrinidad and TobagoTunisiaTurkeyTurkmenistanTurks and Caicos IslandsTuvaluUgandaUkraineUnited Arab EmiratesUnited KingdomUnited StatesUruguayUzbekistanVanuatuViet NamVirgin Islands, BritishVirgin Islands, U.S.Wallis and FutunaWestern SaharaYemenZambiaZimbabweSlovakiaVenezuela, Bolivarian Republic of By submitting this form, you agree to our terms and to receiving communications from Forcepoint, you acknowledge our privacy policy and you consent to the processing of your data. You can unsubscribe at any time. Conversion Type * Company * Newsroom * Work With Us * Executive Team * Blog * Free E-Learning Courses * Feedback * All Products * All Solutions * Customer Stories * Report a Vulnerability * Contact Us Terms & Conditions Legal and Privacy Manage Cookies © 2024 Forcepoint * LinkedIn * Twitter * Facebook * YouTube * RSS We use essential cookies to ensure that our website functions as intended for you. Additionally, Forcepoint requests your consent to use other cookies to collect website usage data, deliver personalized advertising, and to enhance and optimize your browsing experience. To learn more about the cookies we use and how to manage them, visit our Cookie Policy page; to find out how we use and protect personal data, please review our Privacy Policy. Accept All Required Only Manage Cookies Schedule a Demo