Updated 2023-12-11-IOCs-for-Astaroth-Guildma-activity.txt

PaloAltoNetworks · Dec 12, 2023 · d331950 · d331950
1 parent e0075e3
commit d331950
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/2023-12-11-IOCs-for-Astaroth-Guildma-activity.txt b/2023-12-11-IOCs-for-Astaroth-Guildma-activity.txt
@@ -1,5 +1,10 @@
 2023-12-11 (MONDAY): INFECTION FROM BRAZIL PORTUGUESE MALSPAM (ASTAROTH/GUILDMA)
 
+REFERENCES:
+
+- https://www.linkedin.com/posts/unit42_malspam-guildma-astaroth-activity-7140451772770205696-t2d6/
+- https://twitter.com/Unit42_Intel/status/1734686148289777666
+
 NOTES:
 
 - This infection method has previously delivered malware called "Astaroth" or "Guildma."
@@ -107,4 +112,4 @@ RUNNING THE WINDOWS SHORTCUT:
 
 POST-INFECTION C2 TRAFFIC:
 
-- TCP port 27156 - 1.tcp.sa.ngrok[.]io - TCP traffic
+- TCP port 27156 - 1.tcp.sa.ngrok[.]io - TCP traffic