LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0373: Astaroth

Astaroth is a Trojan and information stealer known to affect companies in Europe, Brazil, and throughout Latin America. It has been known publicly since at least late 2017. [1][2][3]

EnterpriseS0373MalwareObject v2.3Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Astaroth is a Windows Trojan and information stealer publicly known since at least 2017 and described by ATT&CK as affecting organizations in Europe, Brazil, and Latin America. Its business significance is not just malware presence; the mapped behaviors show a full theft workflow: user-driven execution, abuse of legitimate Windows components, obfuscation, discovery, credential and clipboard collection, local staging, command-and-control, and exfiltration.

Executive priority

Prioritize Astaroth as a validation case for endpoint visibility, identity-risk reduction, and incident response readiness on Windows systems. Leaders should ask whether the organization can prove collection of process, script, WMI, command-line, file, and network evidence needed to investigate an information-stealing intrusion, especially where user-opened files and legitimate Windows utilities may be involved. This is also relevant for audit evidence around malware defense, credential protection, data loss monitoring, and regional risk where Europe, Brazil, or Latin America exposure matters.

Technical view

ATT&CK provides no official detection text for Astaroth, so defenders should build coverage from the related techniques. Validate monitoring for Windows execution through WMI, cmd, Visual Basic/JScript, CHM, Regsvr32, and shared module loading; stealth indicators such as software packing, encoded/encrypted files, command obfuscation, deobfuscation, and process hollowing; discovery of system, network, time, and running process information; collection via keylogging and clipboard access; local data staging; ingress tool transfer; C2 through dead-drop resolvers and standard encoding; and exfiltration over the C2 channel.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry
  • WMI activity and parent-child process relationships
  • Script execution telemetry for Visual Basic, JScript/JavaScript, and command shell usage
  • Module load and DLL/shared module activity
  • Regsvr32.exe and CHM/HTML Help execution events

Detection direction

  • Because MITRE provides no official detection guidance for this malware object, start with technique-level analytics rather than a single malware signature.
  • Correlate user-opened malicious file behavior with follow-on script, WMI, cmd, Regsvr32, CHM, or module-loading activity on Windows endpoints.
  • Tune for suspicious use of legitimate Windows components while accounting for administrative software, help files, scripts, and management tooling that may create false positives.
  • Look for chained behavior: obfuscated or encoded content, decoding activity, discovery commands, credential or clipboard collection signals, local staging, then outbound C2 or exfiltration-like traffic.
  • Pay special attention to visibility gaps caused by software packing, command obfuscation, encoded files, and process hollowing, since these can reduce the value of simple hash or command-string matching.

Mitigation priorities

  • Reduce user-execution risk through hardened email/web delivery controls and user-focused handling of suspicious files, consistent with the mapped malicious-file execution behavior.
  • Restrict and monitor abuse-prone Windows utilities and scripting paths such as WMI, command shell, Visual Basic/JScript, CHM handling, and Regsvr32 where business operations allow.
  • Strengthen endpoint protection and logging for packed/encoded files, process hollowing, module loading, and suspicious parent-child process chains.
  • Protect credentials by prioritizing controls and monitoring around keylogging risk, clipboard exposure, and unusual authentication activity following suspected infection.
  • Ensure network egress monitoring can identify unusual dead-drop resolver, tool transfer, encoded C2, and exfiltration-over-C2 patterns.
Additional notes and limits

Astaroth is a useful ATT&CK object for testing whether a SOC can connect endpoint, identity, and network evidence into one intrusion narrative. The strongest defensive value comes from validating telemetry coverage across the related techniques, not from treating the malware name alone as a detection strategy.

The supplied ATT&CK object has no official detection text, no aliases, no labels, and no explicit tactics listed on the malware object itself. Technique relationships provide behavioral context, but local prevalence, active campaigns, exact indicators, and confirmed exposure require environment-specific intelligence and telemetry.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Astaroth

Astaroth is a Trojan and information stealer known to affect companies in Europe, Brazil, and throughout Latin America. It has been known publicly since at least late 2017. [1][2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

36 rows
DomainIDNameRelationship / procedure
EnterpriseT1102.001Dead Drop ResolverSub-technique

Astaroth can store C2 information on cloud hosting services such as AWS and CloudFlare and websites like YouTube and Facebook.[3]

EnterpriseT1124System Time Discovery

Astaroth collects the timestamp from the infected machine. [2]

EnterpriseT1564.003Hidden WindowSub-technique

Astaroth loads its module with the XSL script parameter vShow set to zero, which opens the application with a hidden window. [1]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

Astaroth has used an XOR-based algorithm to encrypt payloads twice with different keys.[3]

EnterpriseT1115Clipboard Data

Astaroth collects information from the clipboard by using the OpenClipboard() and GetClipboardData() libraries. [1]

EnterpriseT1082System Information Discovery

Astaroth collects the machine name and keyboard language from the system. [2][1]

EnterpriseT1497.001System ChecksSub-technique

Astaroth can check for Windows product ID's used by sandboxes and usernames and disk serial numbers associated with analyst environments.[3]

EnterpriseT1129Shared Modules

Astaroth uses the LoadLibraryExW() function to load additional modules. [1]

EnterpriseT1059.005Visual BasicSub-technique

Astaroth has used malicious VBS e-mail attachments for execution.[3]

EnterpriseT1057Process Discovery

Astaroth searches for different processes on the system.[1]

EnterpriseT1204.002Malicious FileSub-technique

Astaroth has used malicious files including VBS, LNK, and HTML for execution.[3]

EnterpriseT1140Deobfuscate/Decode Files or Information

Astaroth uses a fromCharCode() deobfuscation method to avoid explicitly writing execution commands and to hide its code. [1][3]

EnterpriseT1132.001Standard EncodingSub-technique

Astaroth encodes data using Base64 before sending it to the C2 server. [2]

EnterpriseT1027.002Software PackingSub-technique

Astaroth uses a software packer called Pe123\RPolyCryptor.[1]

EnterpriseT1218.010Regsvr32Sub-technique

Astaroth can be loaded through regsvr32.exe.[1]

EnterpriseT1518.001Security Software DiscoverySub-technique

Astaroth checks for the presence of Avast antivirus in the C:\Program\Files\ folder. [2]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

Astaroth has been delivered via malicious e-mail attachments.[3]

EnterpriseT1056.001KeyloggingSub-technique

Astaroth logs keystrokes from the victim's machine. [2]

EnterpriseT1574.001DLLSub-technique

Astaroth can launch itself via DLL Search Order Hijacking.[3]

EnterpriseT1059.007JavaScriptSub-technique

Astaroth uses JavaScript to perform its core functionalities. [2][3]

EnterpriseT1041Exfiltration Over C2 Channel

Astaroth exfiltrates collected information from its r1.log file to the external C2 server. [1]

EnterpriseT1220XSL Script Processing

Astaroth executes embedded JScript or VBScript in an XSL stylesheet located on a remote domain. [1]

EnterpriseT1016System Network Configuration Discovery

Astaroth collects the external IP address from the system. [2]

EnterpriseT1055.012Process HollowingSub-technique

Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.[1][3]

EnterpriseT1547.009Shortcut ModificationSub-technique

Astaroth's initial payload is a malicious .LNK file. [2][1]

EnterpriseT1047Windows Management Instrumentation

Astaroth uses WMIC to execute payloads. [2]

EnterpriseT1555Credentials from Password Stores

Astaroth uses an external software known as NetPass to recover passwords. [1]

EnterpriseT1105Ingress Tool Transfer

Astaroth uses certutil and BITSAdmin to download additional malware. [2][1][3]

EnterpriseT1552Unsecured Credentials

Astaroth uses an external software known as NetPass to recover passwords. [1]

EnterpriseT1027.010Command ObfuscationSub-technique

Astaroth has obfuscated and randomized parts of the JScript code it is initiating.[1]

EnterpriseT1564.004NTFS File AttributesSub-technique

Astaroth can abuse alternate data streams (ADS) to store content for malicious payloads.[3]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Astaroth creates a startup item for persistence. [2]

EnterpriseT1218.001Compiled HTML FileSub-technique

Astaroth uses ActiveX objects for file execution and manipulation. [2]

EnterpriseT1568.002Domain Generation AlgorithmsSub-technique

Astaroth has used a DGA in C2 communications.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

Astaroth spawns a CMD process to execute commands. [1]

EnterpriseT1074.001Local Data StagingSub-technique

Astaroth collects data in a plaintext file named r1.log before exfiltration. [2]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1102.001: Dead Drop ResolverEnterpriseuses · TechniqueT1124: System Time DiscoveryEnterpriseuses · TechniqueT1564.003: Hidden WindowEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1115: Clipboard DataEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1497.001: System ChecksEnterpriseuses · TechniqueT1129: Shared ModulesEnterpriseuses · TechniqueT1059.005: Visual BasicEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1132.001: Standard EncodingEnterpriseuses · TechniqueT1027.002: Software PackingEnterpriseuses · TechniqueT1218.010: Regsvr32Enterpriseuses · TechniqueT1518.001: Security Software DiscoveryEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1574.001: DLLEnterpriseuses · TechniqueT1059.007: JavaScriptEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1220: XSL Script ProcessingEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1055.012: Process HollowingEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
2.3
Created
Modified
Raw hash
71f65e9ba853f4d2...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.12.3Current bundle71f65e9ba853…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  2. [2]
    Cofense Astaroth Sept 2018

    Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.

    Open source URL
  3. [3]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  4. [4]
    Cofense Astaroth Sept 2018

    Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.

    Open source URL
  5. [5]
    Cofense Astaroth Sept 2018

    Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.

    Open source URL
  6. [6]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  7. [7]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  8. [8]
    Guildma

    (Citation: Securelist Brazilian Banking Malware July 2020)

  9. [9]
    Guildma

    (Citation: Securelist Brazilian Banking Malware July 2020)

  10. [10]
    Guildma

    (Citation: Securelist Brazilian Banking Malware July 2020)

  11. [11]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  12. [12]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  13. [13]
    mitre-attackS0373
    Open source URL
  14. [14]
    mitre-attackS0373
    Open source URL
  15. [15]
    mitre-attackS0373
    Open source URL
  16. [16]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  17. [17]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  18. [18]
    Cofense Astaroth Sept 2018

    Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.

    Open source URL
  19. [19]
    Cofense Astaroth Sept 2018

    Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.

    Open source URL
  20. [20]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  21. [21]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  22. [22]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  23. [23]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  24. [24]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  25. [25]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  26. [26]
    Cofense Astaroth Sept 2018

    Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.

    Open source URL
  27. [27]
    Cofense Astaroth Sept 2018

    Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.

    Open source URL
  28. [28]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  29. [29]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  30. [30]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  31. [31]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  32. [32]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  33. [33]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  34. [34]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  35. [35]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  36. [36]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  37. [37]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  38. [38]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  39. [39]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  40. [40]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  41. [41]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  42. [42]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  43. [43]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  44. [44]
    Cofense Astaroth Sept 2018

    Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.

    Open source URL
  45. [45]
    Cofense Astaroth Sept 2018

    Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.

    Open source URL
  46. [46]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  47. [47]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  48. [48]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  49. [49]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  50. [50]
    Cofense Astaroth Sept 2018

    Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.

    Open source URL
  51. [51]
    Cofense Astaroth Sept 2018

    Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.

    Open source URL
  52. [52]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  53. [53]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  54. [54]
    Cofense Astaroth Sept 2018

    Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.

    Open source URL
  55. [55]
    Cofense Astaroth Sept 2018

    Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.

    Open source URL
  56. [56]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  57. [57]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  58. [58]
    Cofense Astaroth Sept 2018

    Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.

    Open source URL
  59. [59]
    Cofense Astaroth Sept 2018

    Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.

    Open source URL
  60. [60]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  61. [61]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  62. [62]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  63. [63]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  64. [64]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  65. [65]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  66. [66]
    Cofense Astaroth Sept 2018

    Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.

    Open source URL
  67. [67]
    Cofense Astaroth Sept 2018

    Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.

    Open source URL
  68. [68]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  69. [69]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  70. [70]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  71. [71]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  72. [72]
    Cofense Astaroth Sept 2018

    Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.

    Open source URL
  73. [73]
    Cofense Astaroth Sept 2018

    Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.

    Open source URL
  74. [74]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  75. [75]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  76. [76]
    Cofense Astaroth Sept 2018

    Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.

    Open source URL
  77. [77]
    Cofense Astaroth Sept 2018

    Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.

    Open source URL
  78. [78]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  79. [79]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  80. [80]
    Cofense Astaroth Sept 2018

    Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.

    Open source URL
  81. [81]
    Cofense Astaroth Sept 2018

    Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.

    Open source URL
  82. [82]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  83. [83]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  84. [84]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  85. [85]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  86. [86]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  87. [87]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  88. [88]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  89. [89]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  90. [90]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  91. [91]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  92. [92]
    Cofense Astaroth Sept 2018

    Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.

    Open source URL
  93. [93]
    Cofense Astaroth Sept 2018

    Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.

    Open source URL
  94. [94]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  95. [95]
    Cybereason Astaroth Feb 2019

    Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.

    Open source URL
  96. [96]
    Cofense Astaroth Sept 2018

    Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use