Casbaneiro banking trojan: malicious browser extension operator panel ('Painel Gangster')

Operator web panel of a malicious Chromium browser extension that is installed together with the Casbaneiro banking trojan (also known as Metamorfo and Ponteiro), which targets customers of Portuguese and Brazilian banks, cryptocurrency exchanges and webmail services. Infection starts with a phishing e-mail that leads the victim to install a remote-access client, through which the operators run PowerShell, side-load the trojan's DLL and load the extension into the victim's browser. The extension takes screenshots, steals cookies, captures every form field the victim fills in, including passwords, and injects fake HTML overlays into banking pages on the operator's command. It finds its current server by downloading a small base64-encoded text file from a resolver host and then keeps a WebSocket connection to that server. The panel that controls it is served over plain HTTP on bare IP addresses, in a Portuguese build that brands itself 'Painel Gangster' (login page 'Painel de Monitoramento') and an English build titled 'Monitoring Panel'. This hunt matches the panel's dashboard and login pages by their page code, and tracks the known panel addresses and the resolver and download hosts.