Guildma (Astaroth) malware infection from Brazilian Portuguese email, (Tue, Sep 1st)
Guildma (Astaroth) malware spread via geofenced Brazilian Portuguese phishing emails, using zip archives, shortcuts, and AutoIt loaders.
SANS researchers documented a Guildma (Astaroth) malware infection initiated on 2026-08-31 by a malicious Brazilian Portuguese email offering a DocuSign-themed PDF. The delivery link is geofenced to Brazil and requires Brazilian Portuguese browser and OS language settings, otherwise serving a legitimate installer. The infection chain uses a zip archive containing a Windows shortcut that retrieves a DLL saved as an alternate data stream, which installs a compiled AutoIt package for persistence. Unique SHA-256 indicators and HTTPS traffic to Azure-hosted and .cfd domains were observed, with prior reports noting the campaign's abuse of GitHub.
- Guildma/Astaroth infection via Brazilian Portuguese email with DocuSign lure
- Geofenced delivery: only Brazil IPs with Portuguese settings receive the malware
- Chain: zip archive > Windows shortcut > DLL in alternate data stream > AutoIt loader
- Malware persists under C:\Users\Public\Libraries\.cache\PLAX\; prior campaign abused GitHub
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | aguamammillaria.cfd | h4htc0h0ggdh.canadacentral-01.azurewebsites[.]net plosancol.aguamammillaria[.]cfd crironxil.aguasedum[.]cfd TCP traffic to another domain: |
| domain | aguasedum.cfd | urewebsites[.]net plosancol.aguamammillaria[.]cfd crironxil.aguasedum[.]cfd TCP traffic to another domain: tcp[:]//omzagdmspc.a.pingg |
| domain | colombstracciatella.cfd | r: "Contrato Via Docusing" <contratos_docusing@relatorio01a.colombstracciatella[.]cfd> Date: Wed, 26 Aug 2026 19:01:16 -0300 Subject: Assine co |
| domain | pinggy.link | m[.]cfd TCP traffic to another domain: tcp[:]//omzagdmspc.a.pinggy[.]link:21601/ Note: I saw HTTPS traffic to WhatsApp and GitHub d |
| contratos_docusing@relatorio01a.colombstracciatella | 2026 22:01:41 +0000 (UTC) Sender: "Contrato Via Docusing" <contratos_docusing@relatorio01a.colombstracciatella[.]cfd> Date: Wed, 26 Aug 2026 19:01:16 -0300 Subject: Assin | |
| ipv4 | 185.254.222.105 | ceived: from relatorio01a.colombstracciatella.cfd (unknown [185.254.222.105]) [information removed] ; Wed, 26 Aug 2026 22:01:41 +0000 ( |
| sha256 | 47d2908c4dd7f6f5eb4a8ef4306077b10315c44231f4bacd2bb811b245561911 | e: Zip archive data, at least v2.0 to extract SHA-256 hash: 47d2908c4dd7f6f5eb4a8ef4306077b10315c44231f4bacd2bb811b245561911 File size: 1,553 bytes File name: 868283789726483.lNk File |
| sha256 | a6044786991afdb9d42ceb350943987765a7d0e8537369b2092e3f019c0f63ca | he infection, doesn't appear to be malicious: SHA-256 hash: a6044786991afdb9d42ceb350943987765a7d0e8537369b2092e3f019c0f63ca File size: 266,242 bytes File type: PE32+ executable (DLL) |
| sha256 | cc44782356cb0effc528a7ab22c19ab360a55ebbbe01feb0967031aa191c5869 | d zip archive and extracted Windows shortcut: SHA-256 hash: cc44782356cb0effc528a7ab22c19ab360a55ebbbe01feb0967031aa191c5869 File size: 1,661 bytes File name: 868283789726483.zip File |
| sha256 | f62a958faf0491b2b2803be2ee69b664b58e4a1261f64e8530cdc1a3ff666aa4 | It script for the persistent Guildma malware: SHA-256 hash: f62a958faf0491b2b2803be2ee69b664b58e4a1261f64e8530cdc1a3ff666aa4 File size: 277,874 bytes File type: Data File location: C:\ |
| url | https://sistema-ekg3h4htc0h0ggdh.canadacentral-01.azurewebsites.net/ | 684.BPSE.CONTRATOS.DIGITAIS.pdf Link from the message text: hxxps[:]//sistema-ekg3h4htc0h0ggdh.canadacentral-01.azurewebsites[.]net/ Downloaded zip archive and extracted Windows shortcut: |
From the original article
2 min read at isc.sans.edu
On Monday 2026-08-31, I used a link from a malicious Brazilian Portuguese email to infect a Windows host in my lab. This was a Guildma (Astaroth) malware infection. The link from the email is geofenced for Brazil, meaning that it would only deliver the malware if I checked it from a Brazil-based IP address.
isc.sans.edu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.