Guildma (Astaroth) malware infection from Brazilian Portuguese email

Summary

A Windows host was infected with Guildma (Astaroth) malware through a malicious Brazilian Portuguese email containing a geofenced link. The attack delivers a ZIP archive with a Windows shortcut that downloads content into an alternate data stream within the Temp directory before installing an AutoIt-based payload. The malware then establishes persistence on the compromised system.

Investigation

The investigation reproduced the infection in a lab using a geofenced link configured to deliver malware only when Brazilian language and regional settings were detected. Analysis uncovered the use of a Windows shortcut, alternate data streams, and an AutoIt script to establish persistence. Researchers also examined network traffic in Wireshark to identify Command and Control (C2) domains.

Mitigation

Organizations should use email filtering to block suspicious links and attachments, with particular attention to geofenced or localized phishing campaigns. Security teams should monitor .lnk files that download content into Temp directories and detect creation of alternate data streams. Unauthorized AutoIt execution and unusual persistence artifacts in public directories should also be monitored.

Response

If Guildma activity is detected, affected hosts should be isolated immediately to terminate further C2 communication. Investigators should search for unauthorized files in AppData\Local\Temp and C:\Users\Public\Libraries. Network logs should also be reviewed for connections to known malicious domains and suspicious abuse of legitimate services such as GitHub or WhatsApp for data exfiltration.

## Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary aims to establish a foothold using the Guildma malware technique. They first drop a specially crafted shortcut file named 868283789726483.lNk into a directory. Once the user interacts with this (or it is triggered via a script), the malware creates a hidden configuration/log file located at C:UsersPublicLibraries.cachePLAXBeatz.LEDPRO.09662.8729.422.log. To further evade detection, the malware uses an Alternate Data Stream to hide additional payloads within this log file. This specific sequence of filename creation is what the detection rule targets.

• Regression Test Script:

  # Guildma Malware Infection Simulation Script
  # This script generates the specific file events required by the detection rule.
  
  $targetDir = "C:UsersPublicLibraries.cachePLAX"
  $lnkFile = "868283789726483.lNk"
  $logFile = "Beatz.LEDPRO.09662.8729.422.log"
  
  # 1. Create the directory structure
  if (!(Test-Path $targetDir)) {
      New-Item -Path $targetDir -ItemType Directory -Force | Out-Null
  }
  
  # 2. Simulate the creation of the .LNK file (Selection 1)
  # We create this in the current directory to mimic a download/extraction
  New-Item -Path ".$lnkFile" -ItemType "File" -Force | Out-Null
  Write-Host "[+] Created shortcut file: $lnkFile"
  
  # 3. Simulate the creation of the malicious log file (Selection 2)
  # This file is created in the specific path mentioned in the rule
  $logPath = Join-Path $targetDir $logFile
  New-Item -Path $logPath -ItemType "File" -Force | Out-Null
  Write-Host "[+] Created log file: $logPath"
  
  # 4. Simulate the use of Alternate Data Streams (ADS) as described in the rule
  # This writes content to the 'content' stream of the log file
  Set-Content -Path $logPath -Stream "content" -Value "Malicious Payload Data"
  Write-Host "[+] Applied Alternate Data Stream to $logFile"
  
  Write-Host "[!] Simulation Complete. Check SIEM for alerts."

• Cleanup Commands:

  # Cleanup script to remove simulated artifacts
  Remove-Item -Path ".868283789726483.lNk" -ErrorAction SilentlyContinue
  Remove-Item -Path "C:UsersPublicLibraries" -Recurse -Force -ErrorAction SilentlyContinue
  Write-Host "[+] Cleanup complete."