Astaroth unleashed

Acronis Threat Research Unit (TRU) analyzed an active Astaroth (Guildma) malware campaign primarily targeting Latin America—notably Brazil—affecting manufacturing, IT, financial services and healthcare; the report details a multi-stage infection chain (malicious LNK → JavaScript downloader → PowerShell → AutoIt loader → in-memory DLL/Astaroth binary), advanced evasion (steganography, geofencing, sandbox/hard-drive checks), persistence mechanisms, encrypted configuration files, and provides IOCs (sample hashes and C2 URLs) along with detection notes.