Astaroth

Description

Astaroth is a trojan and information stealer known to affect companies in Europe, Brazil, and throughout Latin America, publicly known since at least late 2017.

Stats

First seen: May 2022
Last seen: October 2026

Also known as

Guildma

MITRE ATT&CK techniques

36 techniques across 9 tactics.

TA0001 Initial Access

T1566Phishing
- T1566.001Spearphishing Attachment

TA0002 Execution

T1047Windows Management Instrumentation
T1059Command and Scripting Interpreter
- T1059.005Visual Basic
- T1059.007JavaScript
- T1059.003Windows Command Shell
T1129Shared Modules
T1204User Execution
- T1204.002Malicious File

TA0003 Persistence

T1547Boot or Logon Autostart Execution
- T1547.009Shortcut Modification
- T1547.001Registry Run Keys / Startup Folder

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
- T1027.002Software Packing
- T1027.010Command Obfuscation
T1055Process Injection
- T1055.012Process Hollowing
T1140Deobfuscate/Decode Files or Information
T1218System Binary Proxy Execution
- T1218.010Regsvr32
- T1218.001Compiled HTML File
T1220XSL Script Processing
T1497Virtualization/Sandbox Evasion
- T1497.001System Checks
T1564Hide Artifacts
- T1564.003Hidden Window
- T1564.004NTFS File Attributes
T1574Hijack Execution Flow
- T1574.001DLL

TA0006 Credential Access

T1552Unsecured Credentials
T1555Credentials from Password Stores

TA0007 Discovery

T1016System Network Configuration Discovery
T1057Process Discovery
T1082System Information Discovery
T1124System Time Discovery
T1518Software Discovery
- T1518.001Security Software Discovery

TA0009 Collection

T1056Input Capture
- T1056.001Keylogging
T1074Data Staged
- T1074.001Local Data Staging
T1115Clipboard Data

TA0011 Command and Control

T1102Web Service
- T1102.001Dead Drop Resolver
T1105Ingress Tool Transfer
T1132Data Encoding
- T1132.001Standard Encoding
T1568Dynamic Resolution
- T1568.002Domain Generation Algorithms

TA0010 Exfiltration

T1041Exfiltration Over C2 Channel

Alert name variants

Alert Name	Engine
ByteCode-MSIL.Trojan.Guildma	ATP Sandbox Adv. Heuristics
Document-HTML.Downloader.Astaroth	ATP Sandbox Adv. Heuristics
Email-MSG.Downloader.Astaroth	ATP Sandbox Adv. Heuristics
Script-JS.Downloader.Astaroth	ATP Sandbox Adv. Heuristics
Script-JS.Downloader.Guildma	ATP Sandbox Adv. Heuristics
Script-JS.Trojan.Astaroth	ATP Sandbox Adv. Heuristics
Script-JS.Trojan.Guildma	ATP Sandbox Adv. Heuristics
Shortcut.Trojan.Astaroth	ATP Sandbox Adv. Heuristics
Win32.Spyware.Guildma	ATP Sandbox Adv. Heuristics
Win32.Trojan.Astaroth	ATP Sandbox Adv. Heuristics
Win32.Trojan.Guildma	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-CNC Win.Trojan.Astaroth outbound connection attempt	IPS-SWG
MALWARE-OTHER Win.Malware.Astaroth variant payload download attempt	IPS-SWG

Related blogs

Ousaban: LATAM Banking Malware Abusing Cloud Services

August 4, 20227 min read