{
  "family": "bestafera",
  "sample_count": 48,
  "category": "trojan",
  "description": "Trojan:Win32/Bestafera is a targeted infostealer and keylogger, notorious for its aggressive focus on capturing sensitive authentication data, specifically targeting online banking credentials, social media logins, and cryptocurrency wallets via advanced input capture techniques.<br><br><b>Understanding Bestafera</b><br>To the end-user, a Bestafera infection operates silently in the background, only becoming apparent when their accounts are hijacked or funds are stolen. For security analysts, Bestafera is a highly capable credential harvester. While not as structurally complex as a bootkit, it excels at quietly recording every action the user takes on the endpoint, prioritizing the theft of high-value authentication tokens over widespread network disruption.<br><br><b>Execution and Evasion Strategies</b><br>Bestafera is typically distributed via spearphishing campaigns containing weaponized Office documents or disguised executables. Upon execution, it establishes persistence, often via the Registry Run keys or Startup folder. It utilizes API hooking (e.g., `SetWindowsHookEx`) to intercept all keyboard input globally (`T1056.001`). It frequently monitors the title of the active window; when a targeted banking portal or email provider is accessed, it may also capture screenshots (`T1113`) to steal on-screen keyboards or two-factor authentication codes. The harvested data is encrypted and exfiltrated to the attacker's C2 server, usually via HTTP POST requests or SMTP (email).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a massive loss of credential security, leading directly to financial theft or data breaches. Threat hunters should investigate EDR alerts for 'Suspicious API Hooking' or 'Anomalous Keylogging Activity'. Network logs will reveal Bestafera reaching out to C2 domains using encrypted traffic. The presence of newly created, hidden `.dat` or `.log` files in the `%Temp%` or `%AppData%` directory (containing the stolen keystrokes) is a strong indicator.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1547.001",
    "T1055",
    "T1048",
    "T1113",
    "T1056.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to halt the active exfiltration of the captured keystrokes and screenshots.",
    "Force a global, mandatory password reset for the compromised user, prioritizing corporate VPN access, email accounts, and financial portals.",
    "Capture a full forensic memory image to extract the active Bestafera payload and identify the specific C2 infrastructure.",
    "Assume all locally typed data has been compromised; perform a clean OS rebuild to ensure the keylogger is completely eradicated."
  ],
  "what_to_avoid": [
    "Do not allow the user to type any passwords or access sensitive portals while the machine is infected.",
    "Avoid assuming the threat is contained just by removing the executable; the exfiltrated passwords must be reset globally."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}