Guildma (Astaroth)

malpedia.caad.fkie.fraunhofer.de • September 1, 2026

First spotted in the wild in 2017, Astaroth is a highly prevalent, information-stealing Latin American banking trojan. It is written in Delphi and has some innovative execution and attack techniques. Originally, this malware variant targeted Brazilian users, but Astaroth now targets users both in North America and Europe.

There is no Yara-Signature yet.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Guildma (Astaroth) Malware Infection via Geofenced Brazilian Email On August 31, 2026, a Windows host was infected with Guildma (Astaroth) malware through a malicious email targeting Brazilian users. The email contained a geofenced link that delivered a ZIP archive with a Windows shortcut, which downloaded content into an alternate data stream in the Temp directory. The malware utilized an AutoIt-based payload to establish persistence on the infected system. The attack was replicated in a lab environment, confirming the geofencing mechanism that restricts malware delivery based on language and regional settings. Analysts identified specific indicators of compromise (IOCs), including SHA-256 hashes for the downloaded files and the domains contacted by the malware. Organizations are advised to implement email filtering and monitor for suspicious activity related to .lnk files and alternate data streams. Immediate isolation of affected hosts is recommended to prevent further command and control communication. 2 sources 67

Extracted Entities

Guildma (Astaroth)

The full story

Extracted Entities

Attack Types (1)

Malware (2)

Tools (1)