Loading malware…
Guildma, also known as Astaroth, is a modular Windows banking trojan and remote access malware family active since at least 2015 and strongly associated with financially motivated campaigns centered on Brazil before later expanding internationally. It combines banking fraud, credential theft, spyware, and remote administration capabilities in a staged architecture built around multiple loaders, injectors, and core modules, with much of its codebase implemented in Delphi and JavaScript. The malware has targeted banks and online services across Latin America and other regions, while historically concentrating on Brazilian users and institutions.
Guildma is commonly delivered through phishing campaigns using malicious attachments, including VBS, LNK, HTML, and ZIP-packaged lures. Infection chains have used script-based downloaders and Windows-native utilities to retrieve and execute additional stages. The malware has also been observed loading through regsvr32 and using hidden-window execution to reduce user visibility.
Once active, Guildma performs extensive host profiling and reconnaissance, including process discovery, timestamp collection, and collection of external IP address information. It monitors browsers, banking applications, and other user activity, and includes keylogging, credential theft, and information-stealing functions. Reported capabilities include theft of login credentials, payment card data, email-related data, and other sensitive information, along with screenshot capture and application-focused monitoring to support banking fraud.
Guildma employs multiple defense-evasion and execution techniques. It has abused NTFS alternate data streams to conceal payload content, used JavaScript and deobfuscation routines such as fromCharCode-based string reconstruction, encoded outbound data with Base64, and performed process hollowing by creating suspended legitimate processes and replacing their memory with malicious code. It also establishes persistence through startup autostart mechanisms.
For command and control, Guildma uses a modular communications design that has included multi-level infrastructure and obfuscated retrieval of downstream servers. Stolen data is exfiltrated to attacker-controlled servers over its command channel. The family has also incorporated spam-enablement components and third-party credential recovery tooling in some campaigns, reflecting its evolution into a broad criminal platform for credential theft and banking fraud.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
TA2725 is a threat actor Proofpoint tracked since March 2022 that is known for using Brazilian banking malware (including Mispadu, Astaroth, and historically Grandoreiro) and credential phishing to target organizations mainly in Brazil, Mexico, and Spain.
...another set of attacks has led to the deployment of the Astaroth banking trojan. Sophos is tracking the second cluster under the moniker STAC3150 since September 24, 2025.
39 distinct techniques documented for this family, organized by ATT&CK tactic.
The LNK file opens a minimized Windows Management Instrumentation Command-line tool (wmic.exe) using the Command Shell (cmd.exe) to download and execute a next stage XSL file with a malicious payload.
The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.
The malware authors have used large amounts of domains, various infection and stealing techniques, and programming languages (Delphi, JS, VBS,..) during Guildma’s long existence
The main purpose of the included JavaScript payload is to download all of Guildma’s modules and execute the first stage DLL module using default Windows tools and applications.
has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails... has required user execution of a malicious MSI installer... has been executed through user installation of an executable disguised as a flash installer.
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
The primary purpose of this module is to inject the GX module into one of the targeted files.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
The malicious JavaScript code is slightly obfuscated with the fromCharCode function or using public web-based obfuscators.
The primary purpose of this module is to inject the GX module into one of the targeted files.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
The complex attack chain, which involves the use of multiple living-off-the-land binaries (LOLBins), results in the eventual loading of the Astaroth malware directly in memory. | The script then uses a LOLBin not previously seen in Astaroth attacks to load the first-stage malware code: ExtExport.exe, which is a legitimate utility shipped as part of Internet Explorer.
The first module (64) is executed using the regsrv32 tool, after all other modules are successfully downloaded.
The LNK file opens a minimized Windows Management Instrumentation Command-line tool (wmic.exe) using the Command Shell (cmd.exe) to download and execute a next stage XSL file with a malicious payload. (MITRE T1220 Squiblytwo Technique)
The module checks whether the NETBIOS name or Volume ID matches one from a hard-coded table... These values correspond to names and IDs of prevalent sandboxing solutions and emulators.
If a URL listed above is found or PuTTY is running, the module starts sniffing keys Enter , Backspace , Delete , Alt , Caps Lock , Ctrl
The second timer tries to access the content of the window and parse the HTML. The content is matched against various element IDs, element options, or expected inputs. If anything matches these rules, the corresponding data is extracted and immediately sent to the second-level C&C server.
Some of these components are credential-stealing plugins hidden inside the ADS stream of desktop.ini. Astaroth abuses these plugins to steal information from compromised systems: NirSoft’s MailPassView... NirSoft’s WebBrowserPassView... | NirSoft’s MailPassView – an email client password recovery tool
This step ends up with the process assigning high priority to itself and subsequently hiding the window... a file named trusted.certs ... is checked for a string called appj.bb.
AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, sw_vers -productVersion, and fsutil.
The module checks for predefined, desktop email client related files and tries to steal saved contacts
The content repeatedly describes malware and threat actors collecting the current date, time, or time zone from victim systems, including examples such as "The net time command can be used... to determine the local or remote system time" and commands like "net time \\hostname" and "w32tm /tz".
The module checks whether the NETBIOS name or Volume ID matches one from a hard-coded table... These values correspond to names and IDs of prevalent sandboxing solutions and emulators.
The module also checks for installed software (antiviruses and “interesting” applications)
Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.
Examples include 'Bazar can also check if the Russian language is installed,' 'DropBook has checked for the presence of Arabic language,' 'Maze has checked the language of the infected system,' and 'SynAck ... checks installed keyboard layouts to estimate if it has been launched from a certain list of countries.'
If a URL listed above is found or PuTTY is running, the module starts sniffing keys Enter , Backspace , Delete , Alt , Caps Lock , Ctrl
The second timer tries to access the content of the window and parse the HTML. The content is matched against various element IDs, element options, or expected inputs. If anything matches these rules, the corresponding data is extracted and immediately sent to the second-level C&C server.
This string is then encoded with Base64 and sent in a GET request to the C&C server.
360 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
136 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Brazilian banking trojan active since at least 2015 that uses layered infection chains, often beginning with Windows shortcut files and a downloader, to load its core payload in memory. In this report it is described as adding a WhatsApp Web spambot component that abuses an already authenticated victim session to harvest contacts and send malicious ZIP attachments in Portuguese to Brazilian numbers.
Referenced only as related reading about a phishing kit tied to two-factor authentication theft; not part of the sextortion scam itself.
Referenced only as related background coverage about credential theft and two-factor authentication phishing, not as part of the sextortion campaign itself.
Astaroth2
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.