Guildma's Brazilian Geofencing: Malware That Only Shows Up for Real Targets

On August 31, 2026, a SANS ISC researcher deliberately infected a Windows host in the lab via a link from a Brazilian Portuguese email. The malware identified is Guildma, also known as Astaroth, a Latin American banking trojan active since 2017. The episode documents a campaign that employs hard geofencing for Brazilian IPs, Portuguese (Brazil) language and region requirements, and concealment techniques based on NTFS Alternate Data Streams and compiled AutoIt packages.

The Localized Trap: Email, Geofencing, and Environmental Conditions

The malicious email was sent on August 26, 2026 at 22:01:41 UTC from relatorio01a.colombstracciatella.cfd, IP 185.254.222.105. The sender was spoofed as "Contrato Via Docusing," with the subject "Assine com o Docusing:CONTRATO_ASSINATURA_FINAL.40572684.BPSE.CONTRATOS.DIGITAIS.pdf." The researcher then used the link in the lab on August 31 to document the full chain.

The geofencing manifested in two layers. First: the link delivers the malicious payload only when queried from an IP geolocated to Brazil. Otherwise, the server returns a legitimate Android Studio installer. Second: the operating system and browser must be configured with Portuguese (Brazil) language and Brazil region. The researcher verified this directly, confirming that without both conditions the malware is not delivered.

The Infection Flow: From ZIP to ADS to AutoIt

The initial file is a ZIP archive containing a Windows shortcut. Once opened, it downloads content from a web server and writes it as an Alternate Data Stream to C:\Users\[username]\AppData\Local\Temp\n1LUQ7.log:h6JSb. ADS is an NTFS filesystem feature that allows attaching alternate data streams to a file without altering its visible size or main content. Many security and forensics tools do not systematically scan ADS, making the technique a documented evasion vector for years.

The ADS in this infection contains a 64-bit DLL that the researcher describes as not apparently malicious. This intermediate DLL functions to retrieve and install the compiled AutoIt package that constitutes the final payload. The AutoIt package is dropped to C:\Users\Public\Libraries\.cache\PLAX\Beatz.LEDPRO.09662.8729.422.log and represents the persistent Guildma malware. AutoIt is a scripting language for Windows automation; its compiler allows generating standalone executables that, in this context, serve as living-off-the-land binaries to evade traditional antivirus signatures.

Indicators of Compromise and Their Uniqueness

The researcher published four distinct SHA-256 hashes for this infection: the ZIP (cc44782356cb0effc528a7ab22c19ab360a55ebbbe01feb0967031aa191c5869), the shortcut (47d2908c4dd7f6f5eb4a8ef4306077b10315c44231f4bacd2bb811b245561911), the DLL in ADS (a6044786991afdb9d42ceb350943987765a7d0e8537369b2092e3f019c0f63ca), and the compiled AutoIt script (f62a958faf0491b2b2803be2ee69b664b58e4a1261f64e8530cdc1a3ff666aa4). Many of these indicators, as noted in the SANS diary, "appear unique to this particular infection." The primary C2 domain is ekg3h4htc0h0ggdh.canadacentral-01.azurewebsites.net, hosted on Microsoft Azure infrastructure.

The researcher observed HTTPS traffic to WhatsApp and GitHub during the infection but judged it legitimate and unrelated to the payload. The abuse of GitHub as a resilience platform is documented in previous Astaroth/Guildma campaigns, but not in this specific August 31, 2026 episode.

"The link from the email is geofenced for Brazil, meaning that it would only deliver the malware if I checked it from a Brazil-based IP address. Otherwise, it would send a legitimate installer (in this case for Android Studio) and not the malware."

Why It Matters

The brief does not document specific remediation measures for this campaign. The source does not specify whether the geofencing techniques rely solely on geolocated IP or also on HTTP headers such as Accept-Language. The method by which the researcher satisfied the Brazilian localization requirements is not detailed: it is unknown whether a VPN, proxy, or a physically Brazil-configured operating system was used.

The exact nature of the DLL in ADS remains partially unclear: the source describes it as "not apparently malicious" but does not clarify whether it is digitally signed, has a known legitimate function, or was generated specifically for this campaign. The dossier also does not specify the detection rate of the hashes on threat intelligence platforms such as VirusTotal, nor quantify the extent of the campaign beyond the sample analyzed in the lab.

The GitHub traffic observed during the infection was not analyzed in depth: the researcher excluded it as legitimate but without providing detailed technical verification elements. The source does not indicate whether the email contained Portuguese text or only a localized sender and subject.

Guildma and the Selective Invisibility of Threats

The documentation of this infection reveals a systemic problem for global threat intelligence: malware that conditions delivery on specific geographic and linguistic parameters evades standard sandboxes and researchers operating outside the designated target. A U.S. or European sandbox analyzing the link without a Brazilian IP and PT-BR system would receive a legitimate Android Studio installer, archiving the investigation as a false positive or abandoned campaign.

The combined use of NTFS ADS and compiled AutoIt indicates a continued evolution of stealth techniques against EDR and traditional antivirus. ADS remains under-scanned not for lack of knowledge, but for the difficulty of integrating its systematic control into enterprise security tools without generating overhead and false positives. AutoIt, a legitimate automation tool, offers a living-off-the-land approach that reduces the detection surface based on signatures.

The August 31, 2026 campaign, though documented in a single lab, exemplifies how geo-linguistic precision renders threats "invisible" to global defenders while remaining highly effective on the local target. For organizations with Brazilian subsidiaries, the relevance is immediate: standard defenses may not trigger if the sample is never delivered to their sensors.

The Astaroth/Guildma family, active since 2017, has extended its presence beyond South America to North America and Europe. The operational maturity shown in this episode — multi-layer geofencing, ADS, AutoIt, Azure cloud infrastructure — suggests that geographic specialization does not imply technical backwardness, but rather a surgical refinement to maximize effectiveness on target and minimize exposure to research.

Sources

• https://isc.sans.edu/diary/rss/33300
• https://malpedia.caad.fkie.fraunhofer.de/details/win.astaroth
• https://developer.ibm.com/articles/alternate-data-streams/
• https://www.autoitscript.com/site/autoit/

Information is based on the cited source and current as of publication.

Sources