{
  "family": "guildma",
  "sample_count": 109,
  "category": "trojan",
  "description": "Trojan:Win32/Guildma is a highly sophisticated, multi-stage banking trojan that primarily targets financial institutions, e-commerce sites, and webmail services in Latin America (LATAM), specifically utilizing advanced web-injects and interactive remote access to facilitate severe financial fraud.<br><br><b>Understanding Guildma</b><br>To the victim, a Guildma infection results in devastating financial theft, often accompanied by the screen suddenly going black while the fraudulent transactions are processed. For threat intelligence analysts, Guildma (part of the infamous Tetrade family of LATAM banking trojans) represents a complex, highly localized threat. It does not simply steal passwords; it is designed to hijack the active banking session, allowing the attacker to bypass 2FA by controlling the victim's mouse and keyboard in real-time.<br><br><b>Execution and Evasion Strategies</b><br>Guildma is primarily distributed via massive, targeted phishing campaigns masquerading as local tax authorities, telecom providers, or shipping companies. The emails contain malicious attachments, often heavily obfuscated VBScript, LNK files, or weaponized PDFs. Upon execution, the malware utilizes an extremely complex, modular infection chain, often leveraging 'living off the land' techniques (abusing BITSAdmin or PowerShell) to download the encrypted payloads. Guildma establishes deep persistence and waits for the user to navigate to a targeted banking portal. Once detected, it initiates a Man-in-the-Browser attack or opens a hidden desktop session (hVNC) allowing the attacker to perform transactions from the victim's machine.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is immediate, catastrophic financial loss. Threat hunters should investigate EDR alerts for 'Suspicious Execution via BITSAdmin', 'Anomalous LNK Execution', or 'Browser Process Injection'. Network logs will reveal Guildma reaching out to custom C2 infrastructure, often hosted on abused cloud providers or compromised local websites. Memory forensics is critical to extract the injected modules and the localized web-inject configuration files.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.001",
    "T1055",
    "T1197",
    "T1056.004",
    "T1185"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1185",
      "name": "Browser Session Hijacking",
      "tactic": "Collection"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1056.004",
      "name": "Input Capture: Credential API Hooking",
      "tactic": "Credential Access"
    },
    {
      "id": "T1197",
      "name": "BITS Jobs",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network to halt the active exfiltration of banking credentials and prevent fraudulent interactive sessions.",
    "Assist the user in immediately contacting their financial institutions to freeze accounts, block recent transactions, and reset all banking passwords.",
    "Capture a live memory image (RAM dump) to extract the injected Guildma DLLs and the downloaded web-inject configuration files.",
    "Perform a clean OS rebuild; Guildma establishes deep, complex hooks in the system that are extremely difficult to eradicate manually."
  ],
  "what_to_avoid": [
    "Do not allow the user to access any online banking or financial portals while the machine is infected.",
    "Avoid rebooting the machine before capturing memory, as the critical web-inject configurations exist only in RAM."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}