Astaroth Targets Brazil Using GitHub Infrastructure

Amber | Attack Report

Astaroth Targets Brazil Using GitHub Infrastructure

Summary

The Astaroth malware has resurfaced in 2025, launching a targeted campaign against Brazil’s banking and cryptocurrency sectors. This variant leverages GitHub repositories as backup command-and-control (C2) infrastructure, enabling operations to persist even if primary servers are taken down.

Distributed through phishing emails disguised as DocuSign messages, Astaroth tricks victims into downloading a malicious ZIP file containing an obfuscated JavaScript loader and AutoIt-based infection chain. Once executed, the malware runs directly in memory and focuses on stealing financial and cryptocurrency credentials from Brazilian institutions.

By embedding configurations and payloads within GitHub repositories, the attackers ensure redundancy, stealth, and operational resilience—strengthening Astaroth’s position as one of Latin America’s most persistent and adaptive banking trojans.

Attack Details

The current Astaroth campaign marks a sophisticated evolution of the banking trojan first seen in 2017, notorious across Latin America for its information-stealing capabilities.

Infection Chain

Phishing Delivery: Victims receive DocuSign-themed phishing emails containing geo-restricted URLs that deliver malicious ZIP files accessible only in Brazil.
JavaScript Execution: The ZIP contains a Windows shortcut (LNK) file embedding obfuscated JavaScript commands, which download multiple components into the ProgramData directory.
AutoIt Loader: These components include an AutoIt interpreter, a compiled AutoIt script, an encrypted payload, and a malware configuration file. The AutoIt script executes and injects shellcode directly into memory.
Payload Activation: The shellcode dynamically loads a Delphi-based DLL, which serves as the main Astaroth payload, resolving APIs, hooking system functions, and executing malicious routines.

Functionality & Evasion

The malware performs extensive anti-analysis checks, scanning for virtual machines, debuggers, and monitoring tools.
If an analysis environment is detected, Astaroth terminates or forces a system shutdown.
When active, it monitors browser sessions for Brazilian banking and crypto websites, capturing credentials and transmitting them via a custom binary communication protocol.
For persistence, Astaroth drops malicious LNK files into the Windows Startup folder, ensuring automatic execution upon reboot.
It also updates its configuration every two hours, embedding updates in image files (steganography) to evade detection.

Geographic Reach

While the current campaign is focused on Brazil, historical data shows Astaroth operations across Mexico, Argentina, Chile, Colombia, Venezuela, and Panama. Prior attacks, such as “Water Makara” (2024), also leveraged phishing techniques to distribute Astaroth payloads.

This iteration’s reliance on cloud-based GitHub infrastructure underscores the malware’s shift toward modular, resilient, and evasive architecture.

Recommendations

Be Cautious with Unexpected Emails: Avoid clicking on links or downloading attachments from unsolicited messages, especially those claiming to be from trusted brands like DocuSign.
Deploy Advanced Email Filtering: Use updated spam and phishing filters to block suspicious emails before reaching end users.
Monitor for Unusual Activity: Track unexpected processes, high CPU usage, and unknown startup entries, which may indicate Astaroth infections.
Restrict Script Execution: Limit the execution of JavaScript, AutoIt, and LNK files from untrusted sources.
Enhance Endpoint Protection: Deploy Next-Generation Antivirus (NGAV) and Endpoint Detection and Response (EDR) tools that utilize behavioral analytics and machine learning to detect obfuscated or memory-resident threats.

Indicators of Compromise (IoCs)

SHA256 Hashes

7418ffa31f8a51a04274fc8f610fa4d5aa5758746617020ee57493546ae35b70
7609973939b46fe13266eacd1f06b533f8991337d6334c15ab78e28fa3b320be
11f0d7e18f9a2913d2480b6a6955ebc92e40434ad11bed62d1ff81ddd3dda945
34207fbffcb38ed51cd469d082c0c518b696bac4eb61e5b191a141b5459669df
28515ea1ed7befb39f428f046ba034d92d44a075cc7a6f252d6faf681bdba39c
a235d2e44ea87e5764c66247e80a1c518c38a7395291ce7037f877a968c7b42b
db9d00f30e7df4d0cf10cee8c49ee59a6b2e518107fd6504475e99bbcf6cce34
251cde68c30c7d303221207370c314362f4adccdd5db4533a67bedc2dc1e6195
049849998f2d4dd1e629d46446699f15332daa54530a5dad5f35cc8904adea43

URLs

hxxps[:]//91[.]220[.]167[.]72[.]host[.]secureserver[.]net/peHg4yDUYgzNeAvm5[.]zip
hxxps[:]//bit[.]ly/49mKne9
hxxps[:]//bit[.]ly/4gf4E7H
hxxps[:]//raw[.]githubusercontent[.]com/dridex2024/razeronline/refs/heads/main/razerlimpa[.]png
hxxps[:]//github[.]com/dridex2024/razeronline
hxxps[:]//github[.]com/Config2023/01atk-83567z
hxxps[:]//github[.]com/S20x/m25
hxxps[:]//github[.]com/Tami1010/base
hxxps[:]//github[.]com/balancinho1/balaco
hxxps[:]//github[.]com/fernandolopes201/675878fvfsv2231im2
hxxps[:]//github[.]com/polarbearfish/fishbom
hxxps[:]//github[.]com/polarbearultra/amendointorrado
hxxps[:]//github[.]com/projetonovo52/master
hxxps[:]//github[.]com/vaicurintha/gol

Domains

clafenval[.]medicarium[.]help
sprudiz[.]medicinatramp[.]click
frecil[.]medicinatramp[.]beauty
stroal[.]medicoassocidos[.]beauty
strosonvaz[.]medicoassocidos[.]help
gluminal188[.]trovaodoceara[.]sbs
scrivinlinfer[.]medicinatramp[.]icu
trisinsil[.]medicesterium[.]help
brusar[.]trovaodoceara[.]autos
gramgunvel[.]medicoassocidos[.]beauty
blojannindor0[.]trovaodoceara[.]motorcycles
1[.]tcp[.]sa[.]ngrok[.]io[:]20262
1[.]tcp[.]us-cal-1[.]ngrok[.]io[:]24521
5[.]tcp[.]ngrok[.]io[:]22934
7[.]tcp[.]ngrok[.]io[:]22426
9[.]tcp[.]ngrok[.]io[:]23955
9[.]tcp[.]ngrok[.]io[:]24080

MITRE ATT&CK TTPs

TA0001 – Initial Access: T1566 (Phishing), T1566.002 (Spearphishing Link)
TA0002 – Execution: T1059 (Command and Scripting Interpreter), T1059.007 (JavaScript), T1059.010 (AutoIt)
TA0003 – Persistence: T1547 (Boot or Logon Autostart Execution), T1547.001 (Startup Folder)
TA0005 – Defense Evasion: T1027 (Obfuscated Files or Information), T1027.003 (Steganography)
TA0007 – Discovery: T1614 (System Location Discovery)
TA0009 – Collection: T1056 (Input Capture), T1056.001 (Keylogging)
TA0010 – Exfiltration: T1041 (Exfiltration Over C2 Channel)
TA0011 – Command & Control: T1071 (Application Layer Protocol), T1090 (Proxy)
Privilege Escalation / Execution Flow: T1574.001 (DLL Hijacking), T1218 (System Binary Proxy Execution), T1218.005 (Mshta)

References

What’s new on HivePro

Get through updates and upcoming events, and more directly in your inbox