<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
Hello,
<div><br class="ContentPasted0">
</div>
<div class="ContentPasted0">I hope everyone is doing well!</div>
<div><br class="ContentPasted0">
</div>
<div class="ContentPasted0">Below is the entry for today.</div>
<div><br class="ContentPasted0">
</div>
<div class="ContentPasted0">11/18/2022 - Diary entry #626:</div>
<div><br class="ContentPasted0">
</div>
<blockquote style="margin-top:0;margin-bottom:0">
<div class="ContentPasted0 ContentPasted1">Astaroth (also known as Guildma and Lucifer) is a Brazilian Banking Remote Access Trojan first documented in 2017, but it was created many years before that. Astaroth is one of the most active banking malware families
in Latin America, targeting victims in Brazil, Chile, Uruguay, Peru, Ecuador, and Colombia, and expanding to other locations such as China, Europe, and North America.
<div><br class="ContentPasted1">
</div>
<div class="ContentPasted1">Early this week, our team analyzed a recent set of samples that were collected from an attack against one of our clients. As soon as the victim infects itself with Astaroth’s downloader (usually by executing a .bat script, a .lnk
shortcut file, or an MSI file), it drops the next-stage malware in a folder along with several files. The malicious payload is executed using AutoIt.exe, a legit freeware scripting language designed for automating Windows GUI and general scripting. This compiled
AutoIt script is responsible for unpacking the final payload code and executing it using the Process Hollowing technique – which injects the code into the svchost.exe process.</div>
<div><br class="ContentPasted1">
</div>
<div class="ContentPasted1">Once executed, the final stage payload (a Delphi-compiled executable) checks for installed Anti Virus programs and steals Browser data (from Firefox, Chrome, and Edge folders), sending them to the attacker’s C2. The executable has
several anti-debugging, anti-sandbox, and anti-analysis techniques such as encrypting all of its strings using a custom algorithm, checking if its process is being hooked, or if any analysis tools are being executed. Once any analysis behavior is detected,
it runs a command line to force the system to shut down.</div>
<div><br class="ContentPasted1">
</div>
<div class="ContentPasted1">When the victim opens the browser and visits any page that matches Astaroth’s target list, it starts a remote connection to the attacker's C2, allowing the malware operator to control the victim’s machine. To perform fraud, they
use social engineering while controlling the machine, inserting overlay images that ask for the victim’s password/token. The list of targeted financial organizations is huge, including but not limited to many Brazilian banks and Cryptocurrency exchanges such
as Binance and Coinbase.</div>
<div><br class="ContentPasted1">
</div>
The sophistication of the attacks allows Astaroth’s operators to quickly launch new campaigns causing new victims to lose money or to have their browser data stolen and leveraged on further attacks.<br>
</div>
</blockquote>
<div><br class="ContentPasted0">
</div>
Kind Regards,<br>
</div>
<div class="elementToProof">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<table style="font-size:medium; font-family:"Times New Roman"">
<tbody>
<tr>
<td style="width:180px" align="left">
<table width="120" align="left">
<tbody>
<tr>
<td colspan="3" align="center"><a href="https://www.appgate.com/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="120" height="30" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/logo@2x.png"></a></td>
</tr>
<tr>
<td colspan="3" align="center"> </td>
</tr>
<tr>
<td width="37%" align="center"><a href="https://www.linkedin.com/company/appgate-security/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="18" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/likedin@2x.png"></a></td>
<td width="28%"><a href="https://twitter.com/AppgateSecurity" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="20" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/twitter@2x.png"></a></td>
<td width="35%"><a href="https://www.youtube.com/channel/UC-8GvxcZbm-R3EJNl8jYjiQ" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="width: 26px; height: 18px; max-width: initial;" width="26" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/youtube@2x.png"></a></td>
</tr>
</tbody>
</table>
<p style="margin-top:0px; margin-bottom:0px"> </p>
</td>
<td colspan="2" rowspan="2" style="width:350px">
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
<strong>MART</strong><br>
</p>
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
Malware Analysis and Research Team<br>
<strong>Appgate</strong></p>
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
E:<span style="margin:0px"> <a title="mailto:ctas-mat@appgate.com" href="mailto:ctas-mat@appgate.com">
ctas-mat@appgate.com</a></span><br>
</p>
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
<br>
<span style="margin:0px; background-color:white"></span></p>
</td>
</tr>
</tbody>
</table>
<br>
</div>
</div>
</div>
</div>
</body>
</html>