Malware
Amatera
Amatera is a stealer written in C++. It conducts anti-sandbox analysis before enumerating browsers, exfiltrating found cryptocurrency files/wallets and possibly credentials.
Indicators of Compromise 47
Domain bsc-testnet-rpc[.]publicnode[.]com Domain fd[.]gstats-api-contact[.]cc Domain kffd3[.]vexlatech[.]cc Domain kffd3[.]vogueatelier[.]cc Domain kr[.]cedar2glanz[.]ru Domain lb[.]propertyfind[.]cc Domain leaguejazire[.]com Domain paternal-angrily[.]com Domain phys[.]stunned-amniotic[.]com Domain pkg[.]vogueatelier[.]cc Domain riyazinikokar[.]xyz Domain static[.]quorashift[.]cc Domain telegra[.]ph Domain update[.]dubbedmuch[.]cc Filename 5bb86c1cd08fe5e1516cba35c85fc03e503bd1b5469113ffa1f1b9e10897f811.exe Filename DCRCVDrv.sys Filename SECOH-QAD.exe Filename Secur32.dll Filename VID001.exe Filename hypersnap.exe Filename pf.ch Filename platform_experience_helper.exe Filename sample.exe Filename tmp00055df5.dll Filename verification.google GitHub Repo github.com/acr/proxy-panel/cmd/bot MD5 2915b3f8b703eb744fc54c81f4a9c67f MD5 38de5b216c33833af710e88f7f64fc98 MD5 9a47c4d379998ade2f8f99e23a630c06 MD5 c2efb2dcacba6d3ccc175b6ce1b7ed0a MD5 f3e82419a43220a7a222fc01b7607adc SHA-256 1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25 SHA-256 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92 SHA-256 5bb86c1cd08fe5e1516cba35c85fc03e503bd1b5469113ffa1f1b9e10897f811 SHA-256 643ef35536ff9273fb84b8504467b1a5645cd3ffd5476d64b99244b02131b205 SHA-256 90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59 SHA-256 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f SHA-256 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 SHA-256 bd36f4c15fe0acb6748da5ed12e45dcc37d412385812c078d1e4f04730e9f69b SHA-256 c4dd71e347a076ba24bdd2d0ee532ef991c1ef25a2431a19f850942ba2ab16b2 IP 145[.]249[.]109[.]147 IP 212[.]118[.]56[.]166 IP 45[.]150[.]34[.]2 Registry User 0x46790e2Ac7F3CA5a7D1bfCe312d11E91d23383Ff Registry User 0x68DcE15C1002a2689E19D33A3aE509DD1fEb11A5 Registry User 0x7CC3cFC1Ac007B8c6566fD2C7419b15a75473468 Registry User 0x886d310Ac23e05EA705e24E513D19f53793832A9
MITRE ATT&CK TTPs 17
T1027 T1055 T1055.012 T1059.001 T1070.004 T1071.001 T1083 T1085 T1105 T1190 T1202 T1203 T1204.001 T1218.011 T1480 T1497.001 T1566
Obfuscated Files or Information
Defense Evasion
Process Injection
Defense Evasion
Process Hollowing
Defense Evasion
PowerShell
Execution
File Deletion
Defense Evasion
Web Protocols
Command And Control
File and Directory Discovery
Discovery
T1085
Ingress Tool Transfer
Command And Control
Exploit Public-Facing Application
Initial Access
Indirect Command Execution
Defense Evasion
Exploitation for Client Execution
Execution
Malicious Link
Execution
Rundll32
Defense Evasion
Execution Guardrails
Defense Evasion
System Checks
Defense Evasion
Phishing
Initial Access
Source Articles
We've got one word for it, and it's usually the wrong one
Cisco Talos identified a complex WebDAV-based infection chain used in an attack against a Ukrainian government organization. The campaign is attributed to the Russian threat actor UAT-10820 and delivers multiple payloads, including the Amatera stealer, ZigCryptoStealer, and NetSupport Manager. The attackers abuse legitimate infrastructure such as the BNB Smart Chain for hosting and use fake CAPTCHA prompts to evade detection. The operation is assessed as opportunistic, focused on stealing cryptocurrency and credentials, with techniques including memory-resident malware, DLL sideloading via 'rundll32.exe', and use of vulnerable drivers to disable EDR solutions.
talos ·1mo ago
ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager
Cisco Talos identified a multi-stage WebDAV-based infection chain dubbed ClearFake, delivering the Amatera stealer and secondary payloads including ZigCryptoStealer and NetSupport Manager. The attack begins with malicious JavaScript injected via a compromised site and Cloudflare Worker, retrieving code from BNB Smart Chain contracts, leading to a fake CAPTCHA prompt that tricks users into executing a malicious command. This command retrieves a disguised DLL over WebDAV and executes it via rundll32.exe. Two distinct loader variants—'pf.ch' and 'verification.google'—were observed, both delivering Amatera stealer with different secondary payloads based on C2 instructions. The 'pf.ch' chain delivers ZigCryptoStealer and a Go reverse proxy, while the 'verification.google' chain installs an unauthorized NetSupport Manager instance, indicating a Russian threat actor.
talos ·1mo ago