Astaroth’s latest campaign uses WhatsApp Web to harvest contacts and automatically send malicious ZIP archives, enabling rapid worm-like propagation while maintaining a Delphi-based banking payload for credential theft. The operation bundles an MSI installer and a Python-based spreader (zapbiu.py) that exfiltrates contact lists and monitors browsing to steal banking credentials. #Astaroth #WhatsApp
Keypoints
- The campaign, internally called Boto Cor-de-Rosa, targets primarily Brazilian users and leverages WhatsApp as a propagation channel.
- Infection starts via a malicious ZIP sent over WhatsApp containing an obfuscated Visual Basic (VBS) downloader disguised as a benign file.
- The VBS downloader retrieves two components: the core Astaroth MSI banking payload and a Python-based WhatsApp spreader (zapbiu.py).
- The MSI installer deploys files to C:PublicMicrosoftEdgeCache_6.60.2.9313 and uses a legitimate AutoIt interpreter plus an encoded loader to dynamically decrypt and load the main payload.
- The Python spreader harvests WhatsApp contacts, sends malicious ZIPs to those contacts with context-appropriate salutations, and exfiltrates the contact list to a remote server.
- The banking module silently monitors browsing activity and activates credential-stealing behaviors when banking-related URLs are accessed.
MITRE Techniques
- [T1059.005 ] Command and Scripting Interpreter (Visual Basic) – The initial downloader is a VBS script that retrieves and executes further components. (‘the VBS script retrieves and executes two additional components — the core Astaroth banking payload and the Python-based WhatsApp spreader’)
- [T1105 ] Ingress Tool Transfer – The campaign downloads and installs multiple components (MSI, Python, zapbiu.py) to the victim system to continue the attack. (‘the VBS script retrieves and executes two additional components — the core Astaroth banking payload and the Python-based WhatsApp spreader’)
- [T1027 ] Obfuscated Files or Information – The VBS downloader is heavily obfuscated to hinder analysis and detection. (‘heavily obfuscated to hinder analysis’)
- [T1566.003 ] Phishing: Spearphishing via Service – The spreader sends malicious ZIP attachments over WhatsApp to contacts to induce execution and further propagation. (‘message on WhatsApp containing a malicious ZIP archive’)
- [T1041 ] Exfiltration Over C2 Channel – The WhatsApp spreader exfiltrates harvested contact lists to a remote server. (‘exfiltrates the victim’s contact list to a remote server’)
- [T1555.003 ] Credentials from Web Browsers – The banking module monitors browsing and activates credential‑stealing when banking-related URLs are visited. (‘When banking-related URLs are accessed, it activates credential‑stealing functionality’)
- [T1218 ] Signed Binary Proxy Execution – The MSI dropper includes a legitimate AutoIt interpreter which is used to run an encoded loader that decrypts and loads the main payload. (‘a legitimate AutoIt interpreter is bundled alongside an encoded loader, which dynamically decrypts and loads the main Astaroth payload from disk’)
Indicators of Compromise
- [File Hashes – ZIPs ] Malicious ZIP archives containing the VBS downloader – 098630efe3374ca9ec4dc5dd358554e69cb4734a0aa456d7e850f873408a3553, 073d3c77c86b627a742601b28e2a88d1a3ae54e255f0f69d7a1fb05cc1a8b1e4, and 1 more hash
- [File Hashes – MSI Installers ] MSI installers deploying Astaroth and supporting files – c185a36317300a67dc998629da41b1db2946ff35dba314db1a580c8a25c83ea4, 5d929876190a0bab69aea3f87988b9d73713960969b193386ff50c1b5ffeadd6, and other hashes
- [File Hashes – Python Spreader ] zapbiu.py / WhatsApp spreader module – 01d1ca91d1fec05528c4e3902cc9468ba44fc3f9b0a4538080455d7b5407adcd025dccd47 (long single artifact hash shown)
- [Domains ] Command/exfiltration and campaign infrastructure contacted – centrogauchodabahia123[.]com, coffe-estilo[.]com, and 3 more domains
- [File names / Paths ] Example filenames and dropped locations used in the chain – ZIP example: 552_516107-a9af16a8-552.zip; installer name: installer.msi; Python module: zapbiu.py; drop path: C:PublicMicrosoftEdgeCache_6.60.2.9313