Astaroth
Software · ATTACK:enterprise:S0373
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0373",
"title": "Astaroth",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0373",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--edb24a93-1f7a-4bbf-a738-1397a14662c6",
"external_id": "S0373",
"domain": "enterprise",
"created": "2019-04-17T13:46:38.565Z",
"modified": "2024-09-25T15:03:49.408Z",
"version": "2.3",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Guildma"
},
{
"source_name": "Cofense Astaroth Sept 2018",
"url": "https://web.archive.org/web/20200302071436/https://cofense.com/seeing-resurgence-demonic-astaroth-wmic-trojan/"
},
{
"source_name": "Securelist Brazilian Banking Malware July 2020",
"url": "https://securelist.com/the-tetrade-brazilian-banking-malware/97779/"
},
{
"source_name": "Cybereason Astaroth Feb 2019",
"url": "https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research"
}
]
}Explicit source assertions (36)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1102.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00914655-1a22-40ed-ae4d-6adb1a6acd35
Securelist Brazilian Banking Malware July 2020ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--04d60222-e8da-4de5-bc58-dcfae65986f5
Cofense Astaroth Sept 2018ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--05491bb5-e209-4480-a1a8-9b385efe14ad
Cybereason Astaroth Feb 2019ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--23b77b77-e100-4ac2-93b9-b900a04844cd
Securelist Brazilian Banking Malware July 2020ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1115
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--29bf3ce1-f531-472f-9825-b990aab2f09c
Cybereason Astaroth Feb 2019ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--29d3798c-dc27-4950-abc4-30b48608a746
Cofense Astaroth Sept 2018 · Cybereason Astaroth Feb 2019ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2cfab77c-89d8-4e95-9ef9-43e0a77c5e4d
Securelist Brazilian Banking Malware July 2020ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30c9343b-bb15-494a-a1cf-4449131ec216
Cybereason Astaroth Feb 2019ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--34ad093b-408b-4694-8aba-862f8de10102
Securelist Brazilian Banking Malware July 2020ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--366bf114-ddd3-473a-9468-c82811c6ed70
Cybereason Astaroth Feb 2019ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3683548e-0331-4407-98b0-82253efc0b09
Securelist Brazilian Banking Malware July 2020ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--383301a1-1cf9-4a74-ab22-2ed1a8c2a42b
Cybereason Astaroth Feb 2019 · Securelist Brazilian Banking Malware July 2020ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3a1883a0-8626-4cf0-8e0f-19bf9cf39a30
Cofense Astaroth Sept 2018ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3e36bc27-d1c1-4ccd-bf6d-2868843664c8
Cybereason Astaroth Feb 2019ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1218.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--49eb0604-2dee-4dcd-8029-cdd478033749
Cybereason Astaroth Feb 2019ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f90f58d-de6a-41b8-8ffd-1db5da42db34
Cofense Astaroth Sept 2018ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6d1cd674-0466-4209-b9b5-7ce45ed359d1
Securelist Brazilian Banking Malware July 2020ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6de0bf91-2034-4821-b231-795aa75db97f
Cofense Astaroth Sept 2018ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--70b2e51a-c5c4-48af-8f9c-112a4854e18d
Securelist Brazilian Banking Malware July 2020ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71ec5140-320c-452c-8512-6a787af027c8
Cofense Astaroth Sept 2018 · Securelist Brazilian Banking Malware July 2020ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--76b77ff0-54db-40bd-910b-2776c714075d
Cybereason Astaroth Feb 2019ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1220
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7dc3f129-9cac-4279-a4d2-b5dbe1237f07
Cybereason Astaroth Feb 2019ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--86b41c35-ae4d-418b-9409-07e49d3c769d
Cofense Astaroth Sept 2018ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1055.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--87a90347-6f15-461c-a44c-9acf503a606b
Cybereason Astaroth Feb 2019 · Securelist Brazilian Banking Malware July 2020ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1547.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8d34f263-bd94-44a4-b8ec-b6cae06dcdd2
Cofense Astaroth Sept 2018 · Cybereason Astaroth Feb 2019ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a04db303-7ae6-4ecd-a397-f3e964bd6e3c
Cofense Astaroth Sept 2018ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1555
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--abe93e80-2fc7-4c71-846e-b476529b4ae6
Cybereason Astaroth Feb 2019ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad731b3e-709e-49d0-a501-6fe69f78a428
Cofense Astaroth Sept 2018 · Securelist Brazilian Banking Malware July 2020 · Cybereason Astaroth Feb 2019ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1552
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--be30816a-854a-4568-ade5-8baa60fa087c
Cybereason Astaroth Feb 2019ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c97d4d74-994a-48eb-8175-5e897c98b99a
Cybereason Astaroth Feb 2019ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1564.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cb11ee03-ac58-417a-a50b-4c3229e226a5
Securelist Brazilian Banking Malware July 2020ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e772ce2d-bc2b-4e7f-af67-700737c75d2c
Cofense Astaroth Sept 2018ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1218.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e94d140f-9345-48bc-9fb9-f48a117e0739
Cofense Astaroth Sept 2018ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1568.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ec60f1d2-2bb3-459d-8095-5bda47927226
Cybereason Astaroth Feb 2019ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f1286eda-5b9a-4fd9-a506-bcc3b2870550
Cybereason Astaroth Feb 2019ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f26e1997-733e-4c3c-ac26-294048466c52
Cofense Astaroth Sept 2018