Astaroth (Guildma) Banking Trojan Uses Steganography and Ngrok Tunnels for C2 Resilience — Threadlinqs Intelligence
As of 2026-07-28, Astaroth (Guildma) Banking Trojan Uses Steganography and Ngrok Tunnels for C2 Resilience is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-1738 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Astaroth (aka Guildma), a Delphi-based Windows banking trojan active since 2015/2017 and targeting Brazil and Latin America, routes C2 traffic through Ngrok reverse-proxy tunnels and pulls fresh
Astaroth (also tracked as Guildma, MITRE ATT&CK software S0373) is a Delphi-written banking trojan and information stealer first reported in the wild circa 2015 and publicly documented since late 2017, primarily targeting Brazil (over 90% of infections) with secondary spread across Latin America (Mexico, Uruguay, Argentina, Peru, Colombia, Venezuela) and isolated hits in the United States and Austria.
Historically, Astaroth has been distributed via DocuSign-themed and government/HR-themed phishing emails containing geo-restricted ZIP archives with malicious LNK files. The LNK contains obfuscated JavaScript that fetches further JavaScript from hard-coded servers, which in turn drives an AutoIt loader that decodes shellcode to load a Delphi-based DLL, ultimately injected into RegSvcs.exe via process hollowing. Persistence is achieved by dropping the LNK into the Windows Startup folder or writing Registry Run keys. Two named 2024 distribution clusters — PINEAPPLE (abusing legitimate cloud services) and Water Makara (obfuscated JavaScript LNK loaders) — have been documented pushing Astaroth into Brazilian manufacturing, retail, and government-sector targets.
As of September 2025, a new campaign tracked by Sophos as STAC3150 (and by Acronis Threat Research Unit as "Boto Cor-de-Rosa") shifted the delivery vector to WhatsApp, abusing the "View Once" message feature to deliver ZIP archives containing malicious VBS or HTA files. Execution triggers PowerShell, which in early September 2025 retrieved second-stage payloads over IMAP from attacker-controlled email accounts, shifting to HTTP (PowerShell Invoke-WebRequest) by early October 2025. A PowerShell/Python script using Selenium Chrome WebDriver and the WPPConnect JavaScript library harvests the victim's WhatsApp contact list and session tokens; a newly added Python-based worm module then auto-forwards the malicious ZIP to every harvested contact, self-reporting delivery/failure/rate metrics in real time, giving the campaign worm-like self-propagation across WhatsApp's user base. By late October 2025, an MSI installer deploys the Astaroth payload itself via an AutoIt script masquerading as a .log file, establishing registry-based startup persistence. Sophos reported over 250 affected customers, ~95% located in Brazil.
For C2 resilience, Astaroth routes its custom binary-protocol traffic through Ngrok reverse-proxy tunnels to obscure the true operator-controlled server IP and bypass perimeter/firewall detection. When direct C2 contact is unavailable or infrastructure is taken down, the malware falls back to fetching configuration from images hosted on GitHub (and other public platforms, often reached via URL shorteners) with payload data appended after the image's EOF marker or hidden via steganographic encoding in pixel data — refreshed on a two-hour cycle so operators can restore control without needing victims to re-establish contact with primary C2.
Credential theft is performed via a SetWindowsHookExW WH_KEYBOARD_LL system-wide keyboard hook that polls the foreground browser window (Chrome, Firefox, IE/Edge) roughly once per second; keylogging activates only when a banking or cryptocurrency portal (e.g., caixa.gov.br, itau.com.br, santandernet.com.br, binance.com, metamask.io, bitcointrade.com.br) is detected in the active window, minimizing captured noise and analyst visibility.
Anti-analysis is extensive: nearly 1,000 internal strings are protected by a custom three-layer encoding scheme (XOR, byte reversal, session-key decoding); the malware enumerates and avoids running in the presence of debuggers (x32dbg, OllyDBG, IDA Pro, WinDbg), traffic analysis tools (Wireshark), virtualization indicators (QEMU-GA, VirtualBox), and SIEM/EDR agents (splunkd.exe); it fingerprints the volume serial number via GetVolumeInformationW; and — most notably — if the system locale resolves to English (United States), Astaroth treats the environment as a sandbox and triggers an automated syste
Target sectors: banking, finance, cryptocurrency, manufacturing, retail, government administration
Target regions: brazil, Latin America, mexico, uruguay, argentina, peru, colombia, venezuela, united states of america, austria
Detections & IOCs
As of 2026-08-09, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1547, T1115, T1059, T1555, T1132, T1074, T1140, T1568, T1041, T1564
