Takes periodic screenshots of the desktop to capture sensitive information that might not be typed (e.g., virtual keyboards).
The malware contacts a Command & Control (C2) server to download the final stage payload, usually a specialized Banking Trojan . 4. Malware Behavior Once active, the malware performs several invasive actions: Bicho_curioso.rar
The emails often claim to contain "curious" photos, "funny" videos, or urgent documents. The name "Bicho_curioso" (Curious Bug) is a psychological bait designed to bypass the user's caution through intrigue. Takes periodic screenshots of the desktop to capture