Guildma

Overview

Trojan:Win32/Guildma is a highly sophisticated, multi-stage banking trojan that primarily targets financial institutions, e-commerce sites, and webmail services in Latin America (LATAM), specifically utilizing advanced web-injects and interactive remote access to facilitate severe financial fraud.

Understanding Guildma
To the victim, a Guildma infection results in devastating financial theft, often accompanied by the screen suddenly going black while the fraudulent transactions are processed. For threat intelligence analysts, Guildma (part of the infamous Tetrade family of LATAM banking trojans) represents a complex, highly localized threat. It does not simply steal passwords; it is designed to hijack the active banking session, allowing the attacker to bypass 2FA by controlling the victim's mouse and keyboard in real-time.

Execution and Evasion Strategies
Guildma is primarily distributed via massive, targeted phishing campaigns masquerading as local tax authorities, telecom providers, or shipping companies. The emails contain malicious attachments, often heavily obfuscated VBScript, LNK files, or weaponized PDFs. Upon execution, the malware utilizes an extremely complex, modular infection chain, often leveraging 'living off the land' techniques (abusing BITSAdmin or PowerShell) to download the encrypted payloads. Guildma establishes deep persistence and waits for the user to navigate to a targeted banking portal. Once detected, it initiates a Man-in-the-Browser attack or opens a hidden desktop session (hVNC) allowing the attacker to perform transactions from the victim's machine.

Indicators of Compromise & Impact
The impact is immediate, catastrophic financial loss. Threat hunters should investigate EDR alerts for 'Suspicious Execution via BITSAdmin', 'Anomalous LNK Execution', or 'Browser Process Injection'. Network logs will reveal Guildma reaching out to custom C2 infrastructure, often hosted on abused cloud providers or compromised local websites. Memory forensics is critical to extract the injected modules and the localized web-inject configuration files.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.004: Monitor for unauthorized keylogging, screen capturing, or web browser API hooking. Deploy EDR to detect API hooking.
• T1185: Enforce strong MFA and use browser isolation or hardened browsers for sensitive financial or administrative portals to defeat session hijacking.
• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_GUILDMA {
    meta:
        description = "Detects Guildma (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "guildma" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Guildma Activity
id: 0a2e7e052f4b900b557ef6686520d93a
status: experimental
description: Detects generic indicators of the guildma malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*guildma*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the endpoint from the network to halt the active exfiltration of banking credentials and prevent fraudulent interactive sessions.
2. Assist the user in immediately contacting their financial institutions to freeze accounts, block recent transactions, and reset all banking passwords.
3. Capture a live memory image (RAM dump) to extract the injected Guildma DLLs and the downloaded web-inject configuration files.
4. Perform a clean OS rebuild; Guildma establishes deep, complex hooks in the system that are extremely difficult to eradicate manually.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not allow the user to access any online banking or financial portals while the machine is infected.
2. Avoid rebooting the machine before capturing memory, as the critical web-inject configurations exist only in RAM.

References & External Analysis

• Search "guildma" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Scarcruft
• Startp
• Qadars
• Oepass
• Ceeinject

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/guildma.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.