Astaroth (Guildma) Uses Steganography and Ngrok for C2 Resilience

Key Takeaways

• Astaroth, also called Guildma, is a Delphi Windows banking trojan from 2018, with over 90 percent of infections in Brazil.
• Delivery arrives through phishing emails spoofing DocuSign or government documents, and WhatsApp View Once messages carrying malicious archives.
• Before acting, it checks locale, drive serial numbers, and analysis tools, forcing a system shutdown when a sandbox is detected.
• Stolen data travels over TCP through Ngrok tunnels, hiding the operator's true server address from victim network traffic.
• Every two hours it pulls fresh configuration hidden inside steganographic images, recovering resilience after command-and-control takedowns.
• The Picus Platform lets teams simulate Astaroth attacks and validate whether their security controls detect and prevent them.

Astaroth (aka Guildma) is a Windows banking trojan first observed in 2018. Written in Delphi, it targets banking and cryptocurrency portals in Brazil and across Latin America through runtime keylogging and delivers its payload via a multi-stage loader chain that touches AutoIt, in-memory DLL injection, and process hollowing before the final payload ever touches disk.

What separates Astaroth from older credential stealers is its infrastructure resilience model. When primary command-and-control (C2) endpoints become unreachable, the malware fetches updated configuration from steganographically encoded image files hosted on legitimate platforms, making takedown harder.

In this blog, we explain how Astaroth operates across every stage of its execution flow, from the initial phishing lure through process injection and credential exfiltration, and show you how Picus helps validate your security controls against this malware.

What Is Astaroth Malware?

Astaroth is a Windows credential-stealing banking trojan, also known as Guildma, written in Delphi, that first emerged in 2018 and has since evolved significantly in both delivery method and evasion sophistication.

Over 90% of recorded infections are in Brazil, with the remainder spread across other Latin American countries and select European targets.

At its core, Astaroth does three things:

1. Monitors browser activity: It polls active foreground windows once per second, checking for window class names associated with web browsers and matching the page title or URL against a target list of banking and cryptocurrency portals.
2. Captures keystrokes: When a matched banking session is detected in the foreground, Astaroth installs a system-wide keyboard hook to silently record all keystrokes typed into that session.
3. Exfiltrates stolen data: Captured credentials and session data are transmitted to C2 infrastructure routed through Ngrok reverse-proxy tunnels using a custom binary protocol.

How Does Astaroth Malware Work?

Astaroth follows a multi-stage execution flow, from initial phishing delivery through in-memory loading and credential theft.

Below, we will break down each stage in detail.

Stage 1: Initial Access

Astaroth reaches victims through two delivery channels:

• Email-based: Phishing emails spoofing DocuSign, government agencies, or HR documents deliver a geo-restricted ZIP archive containing a malicious LNK file [1][2].
• WhatsApp-based: The STAC3150 campaign, first observed in September 2025, distributes ZIP archives with malicious VBS or HTA files via WhatsApp "View Once" messages [3].

Stage 2: Anti-Analysis and Sandbox Evasion

Depending on the delivery campaign, Astaroth arrives via an AutoIt-based loader chain or an MSI installer, but once injected into RegSvcs.exe the binary itself applies several layers of analysis resistance before performing any malicious activity.

String Encryption

Nearly 1,000 internal strings are encoded using a custom three-layer algorithm [2]. Here is the illustration of the algorithm:

Process and Tool Enumeration

Astaroth enumerates all running processes using a dedicated anti-sandbox function and compares process names against a hardcoded blocklist:

The blocklist covers debugging tools, analysis utilities, virtualization indicators, and monitoring agents [1][2]. Here are the most notable entries:

Volume Serial Number Fingerprinting

Astaroth calls GetVolumeInformationW to retrieve the hard drive's volume serial number and compares the result against a set of known sandbox serial numbers:

Locale-Based Sandbox Detection

If the system locale resolves to English (United States), Astaroth treats the environment as a sandbox and halts execution.

The check decrypts the strings "united" and "states" (and separately "english") at runtime and compares them against the locale reported by GetLocaleInfo [1][2]:

Automated Shutdown on Detection

When any sandbox or analysis condition triggers, Astaroth does not simply exit. It forces a full system shutdown to destroy volatile forensic evidence:

Stage 3: Credential Theft via Keylogging

Once execution is established inside RegSvcs.exe, Astaroth enters a monitoring loop that polls active foreground windows. It inspects the window class name of the active process once per second and activates keylogging when a browser window with a banking or cryptocurrency portal is detected.

Browser window class names monitored [1]:

When a matching window is active, Astaroth installs a system-wide low-level keyboard hook using SetWindowsHookExW with hook type WH_KEYBOARD_LL [1]:

The operator's target list is actively maintained. New portal domains are added with each campaign refresh, with Brazilian financial institutions added at a higher rate than any other geography.

Stage 4: Command-and-Control Communication and Configuration

Stolen keystrokes and session data are transmitted to a C2 endpoint using a custom binary protocol over TCP.

The malware routes this traffic through Ngrok reverse-proxy tunnels, which expose private TCP listeners through publicly accessible Ngrok subdomains. This approach means the attacker's true server IP is never exposed in network traffic observed from the victim.

Astaroth's runtime configuration is stored encrypted in dump.log, co-located with the main payload in the installation directory. The file uses Base64 encoding as its outer layer, with a custom encryption algorithm underneath. The decrypted configuration layout [1]:

Every two hours, Astaroth fetches a fresh configuration to recover from C2 takedowns. It resolves one of the URLs in the out field, which typically chains through a URL shortener to a raw image file hosted on GitHub or a public image platform [1]:

The image file is a valid JPEG or PNG that renders normally. Astaroth identifies and extracts a configuration payload appended after the image's end-of-file marker.

How Picus Simulates Astaroth Malware Attacks?

We strongly suggest simulating Astaroth Malware Attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Platform. You can also test your defenses against hundreds of other malware variants, such as BRICKSTORM, VenomRAT, Chinotto, and Rustonotto, within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for the Astaroth Malware Attacks:

Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Platform.

References

[1] M. Labs, “Astaroth: Banking Trojan Abusing GitHub for Resilience,” McAfee Blog. Accessed: Jul. 17, 2026. [Online]. Available: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/astaroth-banking-trojan-abusing-github-for-resilience/

[2] J. Gegeny and P. Thevendaran, “Astaroth unleashed,” Acronis. Accessed: Jul. 17, 2026. [Online]. Available: https://www.acronis.com/en/tru/posts/astaroth-unleashed/

[3] C. Cowie, “WhatsApp compromise leads to Astaroth deployment,” Sophos. Accessed: Jul. 17, 2026. [Online]. Available: https://www.sophos.com/en-us/blog/whatsapp-compromise-leads-to-astaroth-deployment