Astaroth (Guildma) Uses Steganography and Ngrok for C2 Resilience

**Executive summary:** Astaroth (Guildma) is a Delphi-based Windows banking trojan active since 2018 and heavily focused on Brazil; it is delivered via phishing (email spoofing DocuSign/government) and WhatsApp lures, uses multi-stage AutoIt/MSI loaders with in-memory injection and process hollowing, employs extensive sandbox/analysis checks (locale, volume serial, tool blocklists) and forced shutdown on detection, installs system-wide keylogging when targeted banking/crypto browser windows are active, exfiltrates data over TCP through Ngrok tunnels, and refreshes encrypted configuration from steganographic images to increase resilience — Picus provides simulation modules to validate defenses against these behaviors.