Guildma Remote Access Trojan

Guildma is a modular remote access trojan targeting financial and governmental organisations. First observed in 2015 in campaigns primarily targeting South America, Guildma began to see use in global campaigns starting in May 2019.

Threat ID:: CC-3165
Category:: Trojan
Threat Severity:: Medium
Threat Vector:: Email spam, Spear phishing
Published:: 30 July 2019 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Affected platforms

The following platforms are known to be affected:

Microsoft Windows

Microsoft Windows - All versions

Threat details

The majority of Guildma campaigns begin with a spam email containing a ZIP archive file attachment, although it is not uncommon for campaigns to use sophisticated spear-phishing tactics to compromise specific targets. These attachments contain a malicious LNK file which, when opened, invoke the Windows Management Instrumentation Command-line (WMIC) tool to download an XSL file. This XSL file is then used to download Guildma's individual modules and to execute a first-stage loader, which will then install the modules.

Once installed, Guildma will collect user and system information to send back to a command and control server, before awaiting further commands. By default, it has the ability to monitor email and messaging applications, record audio and video, steal account credentials, and install secondary payloads. Guildma will also monitor user browser activity and attempt to phish their information whenever they visit banking related websites.

Remediation steps

Type	Step
	To prevent and detect a trojan infection, ensure that: A robust program of education and awareness training is delivered to users to ensure they don’t open attachments or follow links within unsolicited emails. All operating systems, anti-virus and other security products are kept up-to-date. Regular anti-virus and security scans are performed on your organisation’s estate. All day-to-day computer activities such as email and internet are performed using non-administrative accounts. Strong password policies are in place. Network, proxy and firewall logs should be monitored for suspicious activity. User accounts accessed from affected devices should be reset on a clean computer. Your organisation adopts a holistic all-round approach to Cyber Security as advocated by the 10 Steps to Cyber Security.

Type

Step

To prevent and detect a trojan infection, ensure that:

A robust program of education and awareness training is delivered to users to ensure they don’t open attachments or follow links within unsolicited emails.
All operating systems, anti-virus and other security products are kept up-to-date.
Regular anti-virus and security scans are performed on your organisation’s estate.
All day-to-day computer activities such as email and internet are performed using non-administrative accounts.
Strong password policies are in place.
Network, proxy and firewall logs should be monitored for suspicious activity.
User accounts accessed from affected devices should be reset on a clean computer.
Your organisation adopts a holistic all-round approach to Cyber Security as advocated by the 10 Steps to Cyber Security.

Last edited: 14 February 2020 2:50 pm