Guildma (Astaroth) Malware: New Insights from Brazilian Portuguese Phishing Emails

The illicit world of cybercrime has seen a surge of sophisticated campaigns, one of which is the notorious Guildma (Astaroth) malware. Recently, Guildma has been spreading through clever phishing emails crafted in Brazilian Portuguese, targeting unsuspecting Brazilian users. The malware’s operators wield an intricate understanding of regional context, using it to bypass security measures with ease.

Campaign or TTP Overview

The latest incidents, documented by the SANS Internet Storm Center, reveal that Guildma has adapted its approach to target Brazilian individuals and entities. The campaign is marked by emails written in Brazilian Portuguese, sent to a wide array of targets in Brazil. As observed in September 2023, these emails carried subject lines such as “Comprovante de Pagamento” (“Payment Confirmation”) and “Documento Importante” (“Important Document”), designed to trigger urgency and curiosity.

This campaign exploits the familiarity and trust imbued in regional language and formats, often impersonating well-known Brazilian companies and financial institutions. The attackers leaned into the ethos of tying their lures closely with recognizable branding, leading to increased open rates and engagements.

How It Was Built

The Guildma phishing emails were carefully constructed to evade detection and to lure the target into executing the malware payload. Here’s a breakdown of how this was orchestrated:

Infrastructure Setup: The campaign used legitimate-looking domain names similar to those of authentic businesses. For example, attackers spoofed domains such as

login-bancodobrasil.com

, designed to mimic the URL pattern of a well-known Brazilian bank.
Delivery Mechanism: The phishing emails were distributed through compromised email accounts, lending credibility to the source. These emails also incorporated advanced techniques to bypass spam filters, utilizing custom DKIM and SPF records for higher delivery success rates.
Lure Content: Actual email bodies contained convincing text such as: “Olá, por favor, encontre anexado o comprovante de pagamento. É importante para a regularização do seu cadastro.” This translates to “Hello, please find attached the payment confirmation. It is important for the regularization of your registration.”
Payload Method: The emails contained malicious attachments disguised as PDF files, which upon execution, triggered a payload download. This payload executed a fileless attack using Windows tools to stay under the radar. A typical execution command might look like:


wscript.exe //E:jscript script.js

Why It Worked

Guildma’s effectiveness in this campaign was largely due to several key tactical decisions:

Localized Language Use: The emails deployed the regional Brazilian Portuguese language, thus increasing the trust factor and legitimacy perception among targets. This cultural tailoring was instrumental in higher engagement rates.
Domain Spoofing Tactics: By using domains that closely resembled those of genuine Brazilian entities, the attackers crafted a deception that few recipients would second guess. This made the spoofed emails difficult for targets to distinguish from legitimate ones.
Compromised Email Accounts: Sending phishing emails from already trusted accounts provided a significant trust anchor, making it less likely for recipients to question the authenticity of messages.

The key to a successful phishing campaign lies not just in crafting the lure, but in grounding it in familiarity and perceived reliability.

Operator Takeaways

For red teamers looking to draw lessons from Guildma’s tactics, several actionable insights emerge:

Emphasize Regional Customization: Just as Guildma tailored its emails linguistically and contextually, consider leveraging regional characteristics or recent local events to increase engagement probability.
Utilize Trust-Anchor Tactics: Leveraging compromised accounts to send phishing emails can boost campaign authenticity. The integration of legitimate records such as DKIM and SPF enhances the delivery certainty.
Innovatively Spoof Domains: Craft domains that closely mimic real entities to draw targets into reacting without second-guessing their instincts.

Good / Better / Best

Good: Generic phishing using language translation tools for regional emails.
Better: Phishing campaigns that imitate regional entities but lack refined domain spoofing and infrastructure nuances.
Best: Comprehensive localized phishing mirroring local language nuances, spoofed domains, and using compromised email accounts for natural legitimacy.

References

SANS Internet Storm Center – Guildma (Astaroth) Malware