> Family · sky_jamaica_

~/packetpursuit $ cat /intel/families/sky-jamaica.md

typeentityconfidencehighcreated2026-08-08updated2026-08-08malware-familybanking-trojanlatamdotnetcdpkeyloggingscreen-capturefraud-overlayemail-harvestingtor-proxy

sky_jamaica

.NET C# banking trojan / remote-access toolkit targeting Latin American financial institutions. First observed sample compiled May 2026. Distinguished by heavy abuse of the Chrome DevTools Protocol (CDP) to manipulate browser sessions, a native fraud-overlay "hole" system, and integrated email/WhatsApp contact harvesting via CDP-driven browser automation.

Attribution

  • PDB path: C:\Source\1\ClientDll\obj\x64\Release\sky_jamaica_noexport.pdb ^[strings.txt:5248]
  • Internal DLL name: sky_jamaica_noexport.dll ^[strings.txt:2795]
  • Version string: REV05 ^[strings.txt:5039]
  • Preliminary triage label: skywalker — no internal evidence supports this name; retained as alias only.
  • Language: Portuguese UI strings and Brazilian banking targets indicate LATAM origin.

Build / RE

  • Format: PE32+ (x64) .NET CIL assembly ^[file.txt] ^[rabin2-info.txt]
  • Runtime: .NET Framework 4.x (metadata version v4.0.30319) ^[strings.txt:40]
  • Compiled: Tue May 19 12:00:44 2026 ^[rabin2-info.txt]
  • MVID / GUID: F8E628D6012D442D90C37847F99CC80A1 ^[rabin2-info.txt]
  • Toolchain: Microsoft Visual Studio / MSBuild (standard C# compilation, no AOT)
  • Packing / obfuscation: None. Full unobfuscated symbol names, clear namespace hierarchy (Client.*, Shared.*), ~3,969 functions. ^[rabin2-info.txt] ^[capa.txt]
  • Signing: Unsigned (signed: false)
  • Code quality: Professional, modular architecture with packet-serialized C2, extensive configuration structs, and humanized input simulation (Bezier curves, Gaussian delays, Fitts' law stepping).

Deploy / ATT&CK

TTPs below are inferred from static analysis (CAPE skipped — no Windows guest available).

Tactic Technique Evidence
Collection T1056.001 — Keylogging KeyboardHook.Hook uses SetWindowsHookEx (WH_KEYBOARD_LL) ^[strings.txt]
Collection T1113 — Screen Capture MagnificationCapture via MagInitialize / MagSetWindowSource; fallback BitBlt ^[strings.txt]
Collection T1115 — Clipboard Data ClipboardMonitorStart, ReadAndSendClipboard ^[strings.txt]
Collection T1213 — Data from Information Repositories Email contact harvesting from Outlook Web, Gmail, WhatsApp Web ^[strings.txt]
Command & Control — Raw TCP + WebSocket (WsSend, WsRecv), HTTP GET/POST, optional Tor/SOCKS5 proxy ^[strings.txt]
Defense Evasion T1027 — Obfuscated Files GZip + AES payload encryption for network traffic ^[capa.txt]
Defense Evasion T1497 — Virtualization/Sandbox Evasion ApplyAntiVM, AntiVMApplied, DetectDevTools, ApplyHideProcess, ApplyTokens ^[strings.txt]
Defense Evasion T1564.003 — Hidden Window MakeSilentInstanceInvisible, layered-window manipulation for CDP browsers ^[strings.txt]
Defense Evasion T1070.004 — File Deletion CleanupFilesOnExit, CleanSentItems, CleanDeletedItems ^[strings.txt]
Discovery T1010 — Application Window Discovery EnumWindows, GetWindowThreadProcessId, CheckBrowserWindows, IsWindowVisible ^[strings.txt]
Discovery T1082 — System Information Discovery Exfiltrates 50+ fields: Windows version, DPI, monitors, RAM, CPU, antivirus, firewall, Defender status, .NET version, Office 365 version, etc. ^[strings.txt]
Discovery T1083 — File and Directory Discovery FindChromiumProfiles, GetUserDataDirForBrowser ^[strings.txt]
Discovery T1518 — Software Discovery Enumerates installed browsers, antivirus, firewall, Office 365 ^[strings.txt]
Execution T1047 — Windows Management Instrumentation AntivirusWmi, FirewallWmi queries ^[strings.txt]
Exfiltration — Contact lists and credentials exfiltrated via C2 TCP/WebSocket ^[strings.txt]
Impact — Fraud overlay blocks user interaction during banking sessions ^[strings.txt]
Persistence T1547.009 — Shortcut Modification PatchAllShortcuts, PatchSingleShortcut, PatchShortcutsInDir — patches browser shortcuts to inject --remote-debugging-port ^[strings.txt]
Persistence — PatchHostsFile to redirect banking domains; registry writes for extension policy; scheduled tasks (SCHTASKS_EXE) ^[strings.txt]

Capabilities

  • cdp-browser-injection
  • fraud-overlay-hole-system
  • keylogging-setwindowshookex
  • clipboard-monitor
  • magnification-api-screenshot
  • email-harvesting-outlook-gmail-whatsapp
  • browser-extension-sideload-crx3
  • shortcut-modification-persistence
  • hosts-file-redirect
  • tor-socks5-proxy-c2
  • anti-vm-multiple-hypervisors
  • anti-devtools-detection
  • process-hiding-token-manipulation
  • synthetic-humanized-input
  • registry-extension-policy
  • scheduled-task-persistence
  • crypto-wallet-address-replacement
  • single-instance-mutex

Banking Targets

String constants prefixed CASA_ denote targeted institutions ^[strings.txt]:

  • BBVA (CASA_BBVA_NAME)
  • Banorte (CASA_BANORTE_NAME)
  • Santander (CASA_SANTANDER_NAME)
  • Banamex (CASA_BANAMEX_NAME)
  • City (CASA_CITY_NAME)
  • Binance (CASA_BINANCE_NAME)
  • Paxful (CASA_PAXFUL_NAME)
  • Cripto (CASA_CRIPTO_NAME)

Siblings

Single confirmed sample: 7213e78737d5364647a6b0f8a777f133f9e60cb33bb0507d12154faca2c9da3c.

Cross-References