H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Astaroth](https://attack.mitre.org/software/S0373) is a Trojan and information stealer known to affect companies in Europe, Brazil, and throughout Latin America. It has been known publicly since at least late 2017. (Citation: Cybereason Astaroth Feb 2019)(Citation: Cofense Astaroth Sept 2018)(Citation: Securelist Brazilian Banking Malware July 2020)

Labels

malware

36 recorded

Relationships

uses

to Clipboard Data

Technique

uses

to Command Obfuscation

Technique

uses

to Compiled HTML File

Technique

uses

to Credentials from Password Stores

Technique

uses

to Dead Drop Resolver

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to DLL

Technique

uses

to Domain Generation Algorithms

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Hidden Window

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

Technique

uses

to Local Data Staging

Technique

uses

to Malicious File

Technique

uses

to NTFS File Attributes

Technique

uses

to Process Discovery

Technique

uses

to Process Hollowing

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

Technique

uses

to Security Software Discovery

Technique

uses

to Shared Modules

Technique

uses

to Shortcut Modification

Technique

uses

to Software Packing

Technique

uses

to Spearphishing Attachment

Technique

uses

to Standard Encoding

Technique

uses

to System Checks

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Time Discovery

Technique

uses

to Unsecured Credentials

Technique

uses

to Visual Basic

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Management Instrumentation

Technique

uses

to XSL Script Processing

Technique

5 external

References

mitre-attack

S0373

Guildma

—

Cofense Astaroth Sept 2018

https://web.archive.org/web/20200302071436/https://cofense.com/seeing-resurgence-demonic-astaroth-wmic-trojan/

Securelist Brazilian Banking Malware July 2020

https://securelist.com/the-tetrade-brazilian-banking-malware/97779/

Cybereason Astaroth Feb 2019

https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research