How to remove SORVEPOTEL malware

What kind of malware is SORVEPOTEL?

SORVEPOTEL is a piece of malicious software used to target banking information. It is capable of rapid self-proliferation via the WhatsApp messaging/communication service. SORVEPOTEL has been used to target users in Brazil. This malware has compromised Brazilian governmental institutions and organizations within the construction, technology, and education spheres.

SORVEPOTEL malware overview

As mentioned in the introduction, SORVEPOTEL can self-spread through WhatsApp accounts that the malware itself is capable of compromising. Affected accounts are used to send deceptive messages in Portuguese to all contacts and groups. The messages distribute a malicious ZIP file that can supposedly be accessed only via the computer.

The exact text may differ, yet the crux is luring recipients into downloading and opening the archive file. The ZIP contains an LNK (Windows shortcut) file that, upon launch, triggers the infection chain. It is a multi-stage process involving several loaders and payloads.

The first step is to establish contact with a C&C (Command and Control) server; from it, a PowerShell script (typically, in a BAT – batch file) is downloaded. This script is responsible for ensuring persistence on the infected device (by setting itself to automatically start upon each system reboot) and connecting to another C&C.

SORVEPOTEL seeks to maintain contact with multiple C&C servers from which it may then download subsequent payloads. The downloaded content is then loaded in-memory. At the time of research, SORVEPOTEL was seen utilizing two payloads – one targeting finance-related data and another hijacking WhatsApp accounts and self-proliferating through them.

The malware utilizes anti-analysis and anti-debugging mechanisms. The program monitors active browsers and visited URLs for access to websites of interest.

At the time of writing, SORVEPOTEL checked for visits to various cryptocurrency-related sites and Brazilian bank websites. Some of the targets include: Binance, Blockchain.com, Banco BMG, Banco Bradesco, Banco do Brasil, Banco Pan, Banco Safra, Banestes (Banco do Estado do Espirito Santo), Banpará, Banrisul, and Caixa Econômica Federal.

The stealer payload is utilized to steal financial information. This payload is a .NET executable that confirms whether the victim is located in Brazil by checking related system settings. Some of the commands that this payload can execute include: terminate running processes, obtain a list of opened windows, minimize/maximize opened windows, monitor mouse/keyboard activity, take screenshots, record keystrokes (keylogging), and display overlay screens capable of blocking user interaction.

SORVEPOTEL has shown full-screen overlays disguised as bank security alerts and ones imitating online banking sign-in pages. When a victim attempts to access their bank account, the website is overlaid with a phishing screen that records entered log-in credentials (e.g., usernames/passwords, 2FA/MFA codes, PINs, QR codes, e-signatures, etc.).

The second payload is also a .NET executable. It searches for active WhatsApp sessions. If such a session is detected, the program drops Selenium and a Google Chrome browser driver – these tools are used to gain control of the browser.

A JavaScript bundle is employed to access the internal functions of WhatsApp Web and leverage them for self-spreading purposes (i.e., to send malspam causing SORVEPOTEL infections). Due to the accounts being used to send messages in bulk, they are often suspended for suspected spam.

It must be mentioned that since this infection relies on the download of payloads, the resulting infections and its capabilities may differ based on what content is infiltrated into the device. What is more, malware developers commonly improve upon their software and methodologies. Therefore, possible future iterations of SORVEPOTEL could have additional/different functionalities.

In summary, the presence of software like SORVEPOTEL on devices can lead to multiple system infections, severe privacy issues, financial losses, and identity theft.

Banking malware examples

We have investigated countless malicious programs; Osprey, BlackMoon, CarnavalHeist, and CHAVECLOAK are just some of our articles on software that has been used to steal banking information.

Malware is a broad term that covers software with various functions. Thus, they and the attackers' goals determine the threats posed by the infection. However, regardless of how malicious software operates – its presence on a system endangers device and user safety. Therefore, all threats must be eliminated immediately upon detection.

How did SORVEPOTEL infiltrate my computer?

SORVEPOTEL self-proliferates via malspam sent through WhatsApp. The malware compromises the accounts itself. When SORVEPOTEL detects an active WhatsApp session, it utilizes Selenium, a Chrome driver, and a JavaScript bundle to hijack the account and use it to mass-send spam. The messages are sent to all contacts and groups of an affected account.

During research, SORVEPOTEL targeted Brazilian users, and the spam messages were in Portuguese. The text therein was designed to lure recipients into downloading and opening the sent ZIP archive. These files bore titles "ORCAMENTO_114418.zip", "RES-20250930_112057.zip", and other names that implied an association with financial documents or a relation to health applications. The archive contained an LNK file that jumpstarted SORVEPOTEL's infection chain upon execution.

Another type of malspam used to distribute SORVEPOTEL was spam emails. These messages varied in subjects and the bodies of the letters. The emails had ZIP archives (likewise containing LNK files) attached to them, and the following filenames have been observed "COMPROVANTE_20251001_094031.zip", "ComprovanteSantander-75319981.682657420.zip", and "NEW-20251001_133944-PED_1273E322.zip".

Other proliferation methods are not unlikely. Phishing and social engineering are standard in malware distribution. Malicious software is usually disguised as or bundled with ordinary program/media files. They can be archives (ZIP, RAR, etc.), executables (EXE, RUN, etc.), documents (Microsoft Office, Microsoft OneNote, PDF, etc.), JavaScript, and so on. Merely opening an infectious file can be enough to initiate malware download/installation.

The most prevalent malware distribution techniques include: malicious attachments or links in spam (e.g., PMs/DMs, emails, SMSes, social media/ forum posts, etc.), trojans (backdoors/loaders), drive-by (stealthy/deceptive) downloads, malvertising, online scams, dubious download sources (e.g., freeware and third-party websites, Peer-to-Peer sharing networks, etc.), pirated content, illegal software activation tools ("cracks"), and fake updates.

Furthermore, some malicious programs can self-spread via local networks and removable storage devices (e.g., external hard drives, USB flash drives, etc.).

How to avoid installation of malware?

We highly recommend approaching incoming communications with care. Attachments or links found in suspicious/irrelevant mail must not be opened, as they can be virulent. We advise vigilance when browsing since the Internet is full of deceptive and malicious content.

Another recommendation is to download only from official and verified sources. Software must be activated and updated using genuine functions/tools, as those acquired from third-parties can contain malware.

We must emphasize the importance of having a dependable antivirus installed and kept up-to-date. Security programs must be used to run regular system scans and to remove detected threats and issues. If you believe that your computer is already infected, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate infiltrated malware.

Instant automatic malware removal:

Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:

By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.

Quick menu:

• What is SORVEPOTEL?
• STEP 1. Manual removal of SORVEPOTEL malware.
• STEP 2. Check if your computer is clean.

How to remove malware manually?

Manual malware removal is a complicated task - usually it is best to allow antivirus or anti-malware programs to do this automatically. To remove this malware we recommend using Combo Cleaner Antivirus for Windows.

If you wish to remove malware manually, the first step is to identify the name of the malware that you are trying to remove. Here is an example of a suspicious program running on a user's computer:

If you checked the list of programs running on your computer, for example, using task manager, and identified a program that looks suspicious, you should continue with these steps:

Download a program called Autoruns. This program shows auto-start applications, Registry, and file system locations:

Restart your computer into Safe Mode:

Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.

Video showing how to start Windows 7 in "Safe Mode with Networking":

Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup.

Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings".

Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.

Video showing how to start Windows 8 in "Safe Mode with Networking":

Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options".

In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.

Video showing how to start Windows 10 in "Safe Mode with Networking":

Extract the downloaded archive and run the Autoruns.exe file.

In the Autoruns application, click "Options" at the top and uncheck "Hide Empty Locations" and "Hide Windows Entries" options. After this procedure, click the "Refresh" icon.

Check the list provided by the Autoruns application and locate the malware file that you want to eliminate.

You should write down its full path and name. Note that some malware hides process names under legitimate Windows process names. At this stage, it is very important to avoid removing system files. After you locate the suspicious program you wish to remove, right click your mouse over its name and choose "Delete".

After removing the malware through the Autoruns application (this ensures that the malware will not run automatically on the next system startup), you should search for the malware name on your computer. Be sure to enable hidden files and folders before proceeding. If you find the filename of the malware, be sure to remove it.

Reboot your computer in normal mode. Following these steps should remove any malware from your computer. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs.

These steps might not work with advanced malware infections. As always it is best to prevent infection than try to remove malware later. To keep your computer safe, install the latest operating system updates and use antivirus software. To be sure your computer is free of malware infections, we recommend scanning it with Combo Cleaner Antivirus for Windows.

Frequently Asked Questions (FAQ)

My computer is infected with SORVEPOTEL malware, should I format my storage device to get rid of it?

Malware removal rarely requires formatting.

What are the biggest issues that SORVEPOTEL malware can cause?

The dangers associated with an infection depend on the malware's abilities and the attackers' modus operandi. SORVEPOTEL is an information-stealing malware capable of self-proliferation via WhatsApp. It has been used to target banking-related data. Infections of this kind are linked to risks of severe privacy issues, financial losses, and identity theft.

What is the purpose of SORVEPOTEL malware?

Malware is most commonly used for profit. However, attacks may also be driven by the attackers' amusement or personal grudges, process disruption (e.g., websites, services, companies, etc.), hacktivism, and political/geopolitical motivations.

How did SORVEPOTEL malware infiltrate my computer?

SORVEPOTEL has been distributed through email and WhatsApp malspam. It can also self-spread via WhatsApp by hijacking accounts on infected devices and sending malicious archives to all contacts/groups.

However, different distribution techniques are not unlikely. Aside from spam mail, malware is commonly distributed through malvertising, drive-by downloads, trojans, online scams, untrustworthy download sources (e.g., freeware and free file-hosting sites, P2P sharing networks, etc.), pirated software/media, illegal activation tools ("cracks"), and fake updates. Some malicious programs can self-spread via local networks and removable storage devices.

Will Combo Cleaner protect me from malware?

Combo Cleaner can detect and remove most of the known malware infections. Keep in mind that performing a complete system scan is essential since high-end malicious programs usually hide deep within systems.