Guildma Malware Expands Targets Beyond Brazil

guest · Jul 26, 2019

Guildma Malware Expands Targets Beyond Brazil
July 25, 2019
https://www.securityweek.com/guildma-malware-expands-targets-beyond-brazil

Researchers at Avast have published a detailed analysis of a banking trojan they call Guildma. This is almost certainly the same malware as that described by Cybereason as Astaroth, but analyzed here in greater detail.

Avast has detected around 155,000 infection attempts this year alone. Ninety-eight percent are still in Brazil, but the malware is now also targeting 130 banks and web services such as Netflix, Facebook, Amazon, and Google Mail, around the world -- although still avoiding computers running in English.

Guildma is complex and stealthy malware that is a combination of RAT, spyware, password stealer and banking malware. It remains primarily banking malware. "Guildma is highly modular and complex malware supporting a wide range of functionalities, and is currently undergoing rapid development, expanding the range of targeted banks, from Brazil to banks used in other Latin American countries," comments Adolf Streda, malware researcher at Avast and one of the authors of the analysis.
Click to expand...

Avast blog entry

guest · Mar 7, 2020

Brazil is Still the Main Target of the “Guildma” Banking Trojan
March 5, 2020
https://www.technadu.com/brazil-still-main-target-guildma-banking-trojan/94567/

ESET places “Guildma” under the microscope, warning Brazilian internet users of the dangers that come with the popular banking Trojan. The telemetry of the analysts indicates that Guildma, which is also known as “Astaroth”, is probably the most impactful malware of its kind in the area, targeting financial institutions, stealing people’s credentials and email accounts, causing trouble to streaming platforms, grabbing payment data from e-shops, and generally having a widespread presence on the Brazilian cyberspace.

The main channel of distribution for Guildma is through spam emails that carry malicious attachments, and this has been the case for over a year now.
The latest version number “152” came out today, while 151 was released in January and 150 in December.

Guildma remains focused in the Brazilian market, and all entities in the Latin American country are advised to be very careful.
Right now, most AV solutions will identify and flag Guildma’s modules, as it shares common components with other known malware strains like the Casbaneiro and Mispadu.
Click to expand...

ESET: Guildma: The Devil drives electric

In this blogpost, we will examine Guildma (also known as Astaroth, a powerful demon), a highly prevalent Latin American banking trojan. This Brazil-targeting trojan, written in Delphi, boasts some innovative execution and attack techniques. We will describe the most recent version, highlighting the most notable changes made since the middle of 2019 when an avalanche of articles about Guildma was published in response to its largest campaign to date.
Click to expand...

guest · Nov 10, 2020

New Ghimob mobile banking trojan is preparing for international expansion
November 10, 2020
https://www.cybersecurity-help.cz/blog/1735.html

A new remote access trojan has been discovered that is designed to target financial Android apps fr om banks, fintechs, exchanges and cryptocurrencies in Brazil, Paraguay, Peru, Portugal, Germany, Angola and Mozambique.

The new banking malware dubbed Ghimob is believed to has been developed by a Brazil-based threat group Guildma, a threat actor part of the infamous Tйtrade families of banking trojans, known for its scalable malicious activities both in Latin America and other parts of the world.
Ghimob is what security researchers at Kaspersky call “a full fledged spy in tour pocket” - once a device is infected, the trojan’s operators can access it remotely, completing the fraudulent transaction with the victim’s smartphone.

“Even if the user has a screen lock pattern in place, Ghimob is able to record it and later replay it to unlock the device. When the cybercriminal is ready to perform the transaction, they can insert a black screen as an overlay or open some website in full screen, so while the user looks at that screen, the criminal performs the transaction in the background by using the financial app running on the victim’s smartphone that the user has opened or logged in to,” the researchers noted.
Click to expand...

According to Kaspersky, Ghimob is able to spy on 153 mobile apps, mainly from banks, fintechs, cryptocurrencies and exchanges.

“In fact, Ghimob is the first Brazilian mobile banking trojan ready to expand and target financial institutions and their customers living in other countries [...]” the report stated.
Click to expand...

Kaspersky: Ghimob: a Tétrade threat actor moves to infect mobile devices

Conclusions
We believe this campaign could be related to the Guildma threat actor, a well-known Brazilian banking trojan, for several reasons, but mainly because they share the same infrastructure. It is also important to note that the protocol used in the mobile version is very similar to that used for the Windows version.
Click to expand...

Log in or Sign up

Guildma Malware Expands Targets Beyond Brazil

guest Guest

guest Guest

guest Guest

Log in or Sign up

Guildma Malware Expands Targets Beyond Brazil

guest Guest

guest Guest

guest Guest

Useful Searches