Guildma Malware Campaign Targets Brazil with Geofenced, Language-Specific Emails
A new Guildma (Astaroth) malware campaign is using geofenced emails in Brazilian Portuguese to infect targeted Windows users, employing a multi-stage infection chain that includes shortcut files and AutoIt scripts.
A sophisticated malware campaign, identified as an infection by the Guildma (also known as Astaroth) trojan, has been detailed by the SANS Internet Storm Center. The campaign leverages highly targeted phishing emails written in Brazilian Portuguese, designed to deliver malware only to users within Brazil and with specific regional and language settings.
The infection process begins with a malicious email containing a link. This link is geofenced, meaning it will only serve the malicious payload if accessed from a Brazilian IP address. If accessed from elsewhere, or if the user's system does not match the regional and language criteria (Brazilian Portuguese), the link redirects to a legitimate installer, such as for Android Studio, thereby avoiding detection.
Upon successful targeting, the user downloads a ZIP archive. This archive contains a Windows shortcut file (.lnk). When executed, this shortcut initiates a download from a web server. The downloaded content is saved as an Alternate Data Stream (ADS) to a file within the user's AppData\Local\Temp directory. This technique is often used to hide malicious content within legitimate file structures.
The ADS file contains a 64-bit DLL that, while not appearing overtly malicious itself, serves as a crucial component in the infection chain. This DLL is responsible for retrieving and executing an AutoIt package. AutoIt is a freeware scripting language designed for automating the Windows GUI and general scripting, often used by malware authors for its flexibility and ability to evade some security measures.
The AutoIt script then deploys the core Guildma malware, establishing persistence on the infected Windows host. The campaign utilizes a variety of infrastructure, including Azure websites and custom domains, for command and control (C2) communications. Indicators of compromise include specific file hashes for the downloaded shortcut, DLL, and AutoIt script, as well as network traffic to known malicious domains.
This campaign highlights several advanced evasion and targeting techniques. The use of geofencing and language-specific lures significantly narrows the potential victim pool, increasing the likelihood of successful infection by bypassing general security awareness. The multi-stage download and ADS usage further complicate static analysis and detection.
While many of the specific indicators, such as file hashes, appear unique to this particular observed infection, the overall methodology aligns with known Guildma/Astaroth distribution tactics. The campaign's reliance on specific regional configurations underscores the evolving sophistication of threat actors in tailoring their attacks for maximum impact.
Security researchers have noted that this campaign has also been observed abusing GitHub for hosting malicious payloads, a common tactic for malware distributors seeking to leverage legitimate platforms for C2 infrastructure. Users, particularly in Brazil, are advised to exercise extreme caution with unsolicited emails and attachments, especially those requesting immediate action or containing links.