Cisco Talos linked two WebDAV-based infection chains to the Amatera stealer, including a “verification.google” DLL execution seen at a Ukrainian government organization and a parallel “pf.ch” chain delivered through ClearFake, Cloudflare Workers, and EtherHiding. The campaign used Amatera to steal credentials and cryptocurrency data while delivering secondary payloads such as ZigCryptoStealer, a Go reverse proxy, and an unauthorized NetSupport Manager installation, with Talos tracking the “verification.google” activity as UAT-10820. #Amatera #UAT-10820 #NetSupportManager #ZigCryptoStealer #ClearFake #EtherHiding
Keypoints
- Cisco Talos observed a DLL named “verification.google” executing from a WebDAV path at a Ukrainian government organization.
- Investigators linked that activity to Amatera stealer and a second, similar loader named “pf.ch.”
- The “pf.ch” chain used a Cloudflare Worker, malicious JavaScript, BNB Smart Chain storage, and a fake Google CAPTCHA ClickFix prompt.
- Both branches used disguised DLLs launched by 32-bit rundll32.exe with ordinal #1 execution.
- The “pf.ch” branch delivered secondary payloads including ZigCryptoStealer and a Go-based reverse TCP proxy.
- The “verification.google” branch installed an unauthorized NetSupport Manager client and was assessed with moderate confidence to involve a Russian threat actor.
- Amatera configurations targeted browser data, messaging apps, wallets, password managers, file locations, and other credential-rich sources.
MITRE Techniques
- [T1218.011] Rundll32 – Used to execute disguised DLLs through ordinal #1 in both WebDAV delivery chains. (‘…launched through the 32-bit version of “rundll32.exe”…invoke a function by calling the function ordinal #1…’)
- [T1071.001] Web Protocols – Used WebDAV over web paths to retrieve and execute malicious DLLs. (‘…execution of a DLL file through a WebDAV UNC path…Both observed variants retrieve a 32-bit DLL over WebDAV…’)
- [T1059.007] JavaScript – Malicious JavaScript was injected and used to stage the ClickFix chain and retrieve payloads. (‘…a Cloudflare Worker injects a malicious JavaScript…’)
- [T1059.001] PowerShell – Used as a secondary payload execution path to download and run NetSupport Manager. (‘…retrieves the URL with PowerShell DownloadString and runs it through Invoke-Expression (IEX)…’)
- [T1055] Process Injection / DLL Hollowing – The loader mapped a clean DLL and overwrote it with malicious code before execution. (‘…maps a clean image of the legitimate “dbghelp.dll” in memory and then overwrites the beginning of its code section…’)
- [T1027] Obfuscated Files or Information – Code, configuration, and payloads were Base64/XOR/LZNT1 decoded and packed to hinder analysis. (‘…Base64 decoded and evaluated as JavaScript…XOR and LZNT1 to decode the final Amatera payload…’)
- [T1140] Deobfuscate/Decode Files or Information – Multiple stages decoded embedded data, configs, and shellcode before execution. (‘…the response is Base64 decoded and evaluated as JavaScript…first Base64 decoded and then XOR decoded…’)
- [T1566.002] Phishing: Spearphishing Link – The fake CAPTCHA and clipboard-copy workflow tricked victims into executing commands. (‘…overlays a fake Google CAPTCHA-style checkbox…instructing the victim to open the Windows Run dialog, paste the clipboard contents, and press Enter.’)
- [T1105] Ingress Tool Transfer – Payloads were downloaded from remote servers, blockchain storage, and dead-drop URLs. (‘…download and execution of Amatera stealer…downloaded the file that was likely intended to be downloaded and executed…’)
- [T1090.001] Proxy: Internal Proxy – The Go payload created a reverse TCP proxy to relay traffic through the host. (‘…turns the host into a reverse TCP proxy…’)
- [T1047] Windows Management Instrumentation – The PowerShell stage queried Win32 classes such as Win32_OperatingSystem and Win32_VideoController. (‘It calculates system uptime from Win32_OperatingSystem.LastBootUpTime…It queries Win32_VideoController…’)
- [T1497.001] Virtualization/Sandbox Evasion: System Checks – The PowerShell loader used environment checks to avoid virtualized or low-value systems. (‘…checks…against 36 strings associated with virtual graphics, remote displays, cloud platforms…’)
Indicators of Compromise
- [File names] disguised DLL loaders and payloads – verification.google, pf.ch, secur32.dll, dbghelp.dll, DCRCVDrv.sys, hypersnap.exe, client32.exe, and jquery.min.js
- [Domains] delivery, C2, and gateway infrastructure – leaguejazire[.]com, riyazinikokar[.]xyz, telegra[.]ph, update[.]dubbedmuch[.]cc, lb[.]propertyfind[.]cc, and paternal-angrily[.]com
- [IP addresses] C2 and gateway endpoints – 145.249.109[.]147, 45.150.34[.]2, 212.118.56[.]166, and 145.249.109.147
- [URLs] payload retrieval and dead-drop pages – https[:]//telegra[.]ph/Functions-04-03 and https://kr[.]cedar2glanz[.]ru/jewel[.]js
- [File hashes] recovered samples and archives – SHA-256 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92, 643ef35536ff9273fb84b8504467b1a5645cd3ffd5476d64b99244b02131b205, 1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25, and bd36f4c15fe0acb6748da5ed12e45dcc37d412385812c078d1e4f04730e9f69b
- [Registry/host identifiers] host and deployment values – MachineGuid|zdozwoqx3c, KAKAN, and NSM789508
- [Network objects] blockchain and RPC references – 0x886d310Ac23e05EA705e24E513D19f53793832A9, 0x46790e2Ac7F3CA5a7D1bfCe312d11E91d23383Ff, 0x68DcE15C1002a2689E19D33A3aE509DD1fEb11A5, and bsc-testnet-rpc[.]publicnode[.]com
MITRE Techniques
- [T1053.005] Scheduled Task/Job: Scheduled Task – A task was created to launch NetSupport Manager at user logon. (‘…creates a scheduled task triggered at user logon.’)
- [T1027.005] Embedded Payloads – Secondary payloads were stored inside archives, shellcode blobs, and configuration data. (‘…it can also be an archive file…The URL for the second secondary payload…yielded a binary shellcode blob…’)
- [T1106] Native API – The loaders resolved and invoked low-level Windows APIs and NT functions directly. (‘…dynamically resolves native functions…registerd using the dynamically resolved function TpAllocWork…’)
- [T1202] Indirect Command Execution – Commands were executed through rundll32, IEX, and callback-based loaders. (‘…passes execution through a callback…’)
- [T1012] Query Registry – The malware used MachineGuid and other host-derived values for installation and tracking. (‘…derives an installation path by hashing MachineGuid|zdozwoqx3c…’)
Read more: https://blog.talosintelligence.com/clearfake-webdav-infection-chain/