Guildma (Astaroth) malware infection from Brazilian Portuguese email, (Tue, Sep 1st)

This report documents a lab-confirmed Guildma (Astaroth) infection delivered by a Brazil-geofenced Portuguese phishing link that required Brazilian locale settings; the initial ZIP contained a shortcut that saved a DLL to an NTFS alternate data stream and installed an AutoIt-based persistent payload. The write-up provides IOCs (SHA-256 hashes, filenames, file locations), malicious domains, and network traffic observations to support detection and response.