Astaroth has introduced a novel method for malware propagation, transforming a victim’s WhatsApp Web session into an effective delivery channel for the same malicious software This article explores whatsapp account malware. . This tactic enables attackers to quickly infiltrate personal and professional conversations, bypassing traditional phishing emails or shortcut file infections that were previously the primary means of operation.
Now, this new component shifts delivery methods to WhatsApp Web, allowing for an expanded attack surface from one compromised account to multiple contacts without requiring each message to be written by the attacker. The report from CrowdStrike, shared with ZeroOwl (ZeroOwl), indicates that the activity targets Brazil, filtering for Brazilian phone numbers, Portuguese-language messages, and browser settings matching local users.
The WhatsApp Account as a Malware-Spreading Machine Once activated, the spambot uses WebDriver, a legitimate browser automation tool, to create a hidden session through which it copies the victim's browser profile, including cookies and saved information. Here are the indicators of compromise (IoCs): Type Indicator Description SHA-256 c7c62303ee1a37fd7a6e2db9c590ba75c647bc4d22d7dca50 Encrypted Astaroth spambot SHA-256 ec43a17685e3a555c2eb5f0a2802e9e45d5a2a5d49a080315 Encrypted Astaroth spambot configuration SHA-256 d89105c4d567a95f674ed6eac538e32e288b658a4222a3d52e284a77782af4d5 Decrypted Astaroth spambot Domain stretar7.contabilfacil.sbs Astaroth installer component C2 server Domain graconxonjal.empresaeficiente.sbs Astaroth installer component C2 server Domain plansonval.impostosrapido.top Astaroth installer component C2 server SHA-256 6168d63fad22a4e5e45547ca6116ef68bb5173e17e25fd171 Vareg spambot Python version SHA-256 a1aa786e02fb9a37a71e0f76b052ab284ba877f2aaa2fb28f Vareg spambot PowerShell version URL hxxps://varegjopeaks.com/api Vareg Python-version C2 server URL hxxps://docsmoonstudioclayworks.online/arquiv Vareg PowerShell-version C2 server
