Astaroth Github C2 Configuration Download

Tim Peck@timpeck

•updated Jan 12, 2026•1•1•136

Detects a sequence of events associated with the Astaroth banking trojan, where a script downloads a file from a raw GitHub URL, followed by the execution of an AutoIT interpreter. Astaroth is known to use GitHub to host configuration files disguised as images (steganography).