Malware

Amatera

Amatera is a stealer written in C++. It conducts anti-sandbox analysis before enumerating browsers, exfiltrating found cryptocurrency files/wallets and possibly credentials.

Indicators of Compromise 32

Domain bsc-testnet-rpc[.]publicnode[.]com Domain fd[.]gstats-api-contact[.]cc Domain kffd3[.]vexlatech[.]cc Domain kffd3[.]vogueatelier[.]cc Domain kr[.]cedar2glanz[.]ru Domain lb[.]propertyfind[.]cc Domain leaguejazire[.]com Domain paternal-angrily[.]com Domain phys[.]stunned-amniotic[.]com Domain pkg[.]vogueatelier[.]cc Domain riyazinikokar[.]xyz Domain static[.]quorashift[.]cc Domain telegra[.]ph Domain update[.]dubbedmuch[.]cc Filename DCRCVDrv.sys Filename Secur32.dll Filename hypersnap.exe Filename pf.ch Filename platform_experience_helper.exe Filename verification.google GitHub Repo github.com/acr/proxy-panel/cmd/bot SHA-256 1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25 SHA-256 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92 SHA-256 643ef35536ff9273fb84b8504467b1a5645cd3ffd5476d64b99244b02131b205 SHA-256 bd36f4c15fe0acb6748da5ed12e45dcc37d412385812c078d1e4f04730e9f69b IP 145[.]249[.]109[.]147 IP 212[.]118[.]56[.]166 IP 45[.]150[.]34[.]2 Registry User 0x46790e2Ac7F3CA5a7D1bfCe312d11E91d23383Ff Registry User 0x68DcE15C1002a2689E19D33A3aE509DD1fEb11A5 Registry User 0x7CC3cFC1Ac007B8c6566fD2C7419b15a75473468 Registry User 0x886d310Ac23e05EA705e24E513D19f53793832A9

MITRE ATT&CK TTPs 14

T1027
Obfuscated Files or Information
Defense Evasion
 T1055.012
Process Hollowing
Defense Evasion
 T1059.001
PowerShell
Execution
 T1070.004
File Deletion
Defense Evasion
 T1071.001
Web Protocols
Command And Control
 T1085
T1085
 T1105
Ingress Tool Transfer
Command And Control
 T1190
Exploit Public-Facing Application
Initial Access
 T1202
Indirect Command Execution
Defense Evasion
 T1204.001
Malicious Link
Execution
 T1218.011
Rundll32
Defense Evasion
 T1480
Execution Guardrails
Defense Evasion
 T1497.001
System Checks
Defense Evasion
 T1566
Phishing
Initial Access

Source Articles

ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager
Cisco Talos identified a multi-stage WebDAV-based infection chain dubbed ClearFake, delivering the Amatera stealer and secondary payloads including ZigCryptoStealer and NetSupport Manager. The attack begins with malicious JavaScript injected via a compromised site and Cloudflare Worker, retrieving code from BNB Smart Chain contracts, leading to a fake CAPTCHA prompt that tricks users into executing a malicious command. This command retrieves a disguised DLL over WebDAV and executes it via rundll32.exe. Two distinct loader variants—'pf.ch' and 'verification.google'—were observed, both delivering Amatera stealer with different secondary payloads based on C2 instructions. The 'pf.ch' chain delivers ZigCryptoStealer and a Go reverse proxy, while the 'verification.google' chain installs an unauthorized NetSupport Manager instance, indicating a Russian threat actor.
talos ·1h ago