Astaroth Banking Trojan Adds WhatsApp Web Spambot to Spread Malware Across Brazil

Astaroth operators have expanded their Brazilian banking malware operations by weaponizing a new WhatsApp Web spambot module that turns infected hosts into automated malware relays, marking a significant evolution of the LATAM e-crime ecosystem.

Traditionally propagated via email and archive-based phishing, recent campaigns such as STAC3150 and the “Boto Cor-de-Rosa” operation shifted distribution to WhatsApp messages, using ZIP attachments containing malicious downloaders to install the trojan.

In Q4 2025, this evolution culminated in the integration of a dedicated WhatsApp Web spambot component delivered by Astaroth’s C2 infrastructure, tightly coupled with the existing AutoIt and Delphi loader chain described in prior reporting.

The new spambot module is a 32‑bit Delphi PE, decrypted from the installer using AES-CTS, and it reuses the same DelphiEncryptionCompendium routines that protect Astaroth’s core payload.

Its configuration file employs a custom format (magic word EF01, Base64+AES-CBC with CTS, and an HMAC-SHA256 integrity check keyed with TenHaVunf!@#2026), ensuring only attacker-controlled configs are accepted.

Once active, the spambot downloads a legitimate Selenium-compatible WebDriver for Chrome or Edge via PowerShell, clones the browser profile into C:\Users\Public\Temp\ChromeAuto_<BROWSER_ID><DATE>, and launches a headless browser session on a random local port, stripping standard automation flags to evade “Chrome is being controlled” indicators.

The malware then abuses the WPPConnect/WA-JS JavaScript library a legitimate customer-service automation toolkit to attach to the victim’s WhatsApp Web session, verify login state via interface elements, and begin programmatic contact harvesting and spam delivery.

Active since at least 2015, Astaroth (aka Guildma) has long relied on multi-stage loaders, script-based downloaders, and heavy obfuscation to steal banking credentials from Brazilian users.Crowdstrike said.

Astaroth Banking Trojan

The contact grabber logic is explicitly tuned for Brazil: it removes group, broadcast, and linked-device identifiers and filters telephone numbers to those beginning with the +55 country code, ensuring only Brazilian contacts are targeted.

It then builds a structured list for each victim contact (name, number, assigned identifier) and prepares a malware delivery flow. For each run, the spambot randomly selects a URL from ArrURL, replaces a pattern with a random number to evade static detections, and retrieves a Base64‑encoded ZIP carrying an Astaroth downloader.

Spam messages are composed dynamically: the module parses the local time to choose an appropriate Portuguese greeting, randomly picks entries from ArrMSG and ArrMF, and injects these into a WPPConnect-based script that sends three messages per contact greeting, malware ZIP attachment, and final body text yielding worm-like propagation through trusted, user-facing messaging channels.

Technical analysis links this Astaroth spambot to earlier LATAM WhatsApp malware operations tracked under names such as Vareg, WATER SACI, and Eternidade Stealer, which distributed multiple banking trojans via WhatsApp Web in late 2025.

Configuration keys like FCX, LT, HL, DEL, ArrMSG, and ArrMF align closely with Vareg’s filtro_contatos_excluir, limite_teste, modo_headless, delay_entre_mensagens, mensagem_saudacao, and mensagem_final fields, and both toolsets share identical function and variable naming (for example, enviarParaContato and mensagemSaudacao) and contact-filtering logic.

These overlaps, combined with the timing of Vareg’s apparent cessation and Astaroth’s spambot adoption in Q4 2025, strongly suggest a shared developer or code-sharing arrangement within the LATAM e-crime ecosystem, consistent with prior observations of interconnected Brazilian banking malware families.

Astaroth’s WhatsApp Web spambot capability extends its reach beyond traditional email spam, exploiting the implicit trust users place in their WhatsApp contacts to drive infection at scale.

The use of headless, profile-backed browser automation plus legitimate WebDriver and WPPConnect components complicates detection, allowing campaigns to blend into normal tooling and browser behavior.

Defenders should monitor for unusual WebDriver downloads and execution via PowerShell, unexpected ChromeAuto_<BROWSER_ID><DATE> folders in C:\Users\Public\Temp, headless Chromium activity on random localhost ports, and unauthorized retrieval of WPPConnect/WA-JS from GitHub or related hosting.

Coupled with user training on archive-based lures sent over WhatsApp and conditional blocking of WhatsApp Web in high-risk environments, these controls can help disrupt Astaroth’s latest Brazil-focused spambot campaigns before they convert messaging infrastructures into malware distribution channels.

IOCs

Malware	Description	Indicator
Astaroth spambot	SHA256 hash of encrypted spambot	c7c62303ee1a37fd7a6e2db9c590ba75c647bc4d22d7dca50cfa8879222ac9e1
	SHA256 hash of encrypted spambot configuration file	ec43a17685e3a555c2eb5f0a2802e9e45d5a2a5d49a0803155acbd74d9ecdbd7
	SHA256 hash of decrypted spambot	d89105c4d567a95f674ed6eac538e32e288b658a4222a3d52e284a77782af4d5
	Installer component C2 servers	stretar7[.]contabilfacil[.]sbs graconxonjal[.]empresaeficiente[.]sbs plansonval[.]impostosrapido[.]top

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

$1M Data Breach Warranty is Genuine Protection?: Download 10 Point Free AI SOC Breach Warranty Guide