Astaroth

The attack begins with a message containing a ZIP archive ... For any user, getting a file from a friend on WhatsApp feels much safer than opening a random email.

The attack begins with a message containing a ZIP archive (basically a compressed folder), usually named with a confusing string of digits like 552_516107-a9af16a8-552.zip.

The content repeatedly describes threat actors and malware using WMI/WMIC/wmiexec for remote execution, lateral movement, discovery, persistence, and administrative actions; e.g., 'APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit' and 'Scattered Spider used Windows Management Instrumentation (WMI) to move laterally via Impacket.'

The dropper is a UTF-16LE PowerShell script... The sample sthzr.ps1 arrived as a 6KB UTF-16LE encoded PowerShell file.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.

Astaroth has used malicious files including VBS, LNK, and HTML for execution... Snip3 can gain execution through the download of visual basic files.

The WhatsApp Spreader: This is a new piece of code written in Python (a file named zapbiu.py) that steals your contact list and starts sending out copies of the virus to everyone you know.

AppleSeed has the ability to use JavaScript to execute PowerShell. APT32 has used JavaScript for drive-by downloads and C2 communications. Astaroth uses JavaScript to perform its core functionalities.

If a victim opens this folder, a hidden script triggers a chain reaction.

Sandworm Team leveraged Microsoft Office attachments which contained malicious macros that were automatically executed once the user permitted them... APT29 has used various forms of spearphishing attempting to get a user to open attachments... DarkGate is distributed through phishing links to VBS or MSI objects requiring user interaction for execution.

Numerous malware families and threat groups are described as achieving persistence by adding values under Run/RunOnce/Policies\Explorer\Run Registry keys or by placing shortcuts/files in the Windows Startup folder.

The content repeatedly references malicious shortcut files: e.g., "APT38 has used malicious Word documents and shortcut files," "Bumblebee... opening an ISO file to enable execution of malicious shortcut files and DLLs," and "Mustang Panda distributed malicious LNK objects for user execution."

Numerous malware families and threat groups are described as achieving persistence by adding values under Run/RunOnce/Policies\Explorer\Run Registry keys or by placing shortcuts/files in the Windows Startup folder.

The content repeatedly references malicious shortcut files: e.g., "APT38 has used malicious Word documents and shortcut files," "Bumblebee... opening an ISO file to enable execution of malicious shortcut files and DLLs," and "Mustang Panda distributed malicious LNK objects for user execution."

The content contains many examples of base64, XOR, RC4, AES, Rijndael, custom ciphers, rolling XOR, and multi-layer obfuscation used to hide payloads, strings, scripts, and C2 data.

Later, in October 2025, it was found abusing GitHub to hide its backup files inside images.

Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

Further probing revealed that the malware hides its main files in a very specific spot on the computer: C:\Public\MicrosoftEdgeCache_6.60.2.9313.

Agent Tesla has used ProcessWindowStyle.Hidden to hide windows. APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden. APT28 has used the WindowStyle parameter to conceal PowerShell windows.

Calls [System.Reflection.Assembly]::Load($bytes) -- reflective loading that avoids writing the DLL to disk as a PE file

In February 2025, a version of Astaroth was found that could bypass two-factor authentication to steal Gmail and Microsoft logins.

Agent Tesla has the ability to steal credentials from FTP clients and wireless profiles... APT33 has used a variety of publicly available tools like LaZagne to gather credentials... Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the credential vault and DPAPI.

In February 2025, a version of Astaroth was found that could bypass two-factor authentication to steal Gmail and Microsoft logins.

The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.

The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.

The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.

Examples include "Bazar can also check if the Russian language is installed on the infected machine and terminate if it is found," "DropBook has checked for the presence of Arabic language," and "Maze has checked the language of the infected system using the GetUSerDefaultUILanguage function."

The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.

Agent Tesla can steal data from the victim’s clipboard. APT38 used a Trojan called KEYLIME to collect data from the clipboard. APT39 has used tools capable of stealing contents of the clipboard.

C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding... APT19 HTTP malware variant used Base64 to encode communications to the C2 server... APT33 has used base64 to encode command and control traffic.

ADVSTORESHELL exfiltrates data over the same channel used for C2... Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers... numerous malware and groups sent victim data, files, credentials, or host information over existing C2 channels.