Proofpoint researchers uncovered Amatera Stealer, a rebranded and enhanced malware-as-a-service based on ACR Stealer, delivered primarily through sophisticated ClearFake web inject campaigns utilizing the ClickFix social engineering technique. The malware uses novel evasion tactics such as NTSockets for stealthy command and control communication and WoW64 syscalls to bypass detections, highlighting its increasing sophistication and threat to software wallets, browsers, and messaging applications. #AmateraStealer #ClearFake #ClickFix
Keypoints
- Amatera Stealer is a rebranded, actively developed information stealer closely related to ACR Stealer, sold as a malware-as-a-service (MaaS) with subscription pricing.
- The malware is distributed via ClearFake web inject campaigns leveraging EtherHiding and ClickFix social engineering, including fake CAPTCHA overlays leading to user-executed malicious PowerShell commands.
- Amatera Stealer uses NTSockets to communicate with its hardcoded C2 servers, bypassing common Windows networking APIs and using CDN IP addresses with non-resolving host headers for stealth.
- The malware employs WoW64 syscall dynamic API resolution to evade detection by user-mode hooking and uses sophisticated obfuscation including XOR and Base64 encoding.
- Its capabilities include stealing browser data, crypto wallets, email clients, messengers, and executing secondary payloads such as .exe, .dll, .ps1 files through ShellExecuteA and PowerShell IEX.
- Recent builds removed usage of Steam/Telegram dead drops for C2, favoring direct HTTP communication and incorporating partial HTTPS support.
- ClearFake has evolved to enhance stealth with additional obfuscation, encryption, and staging, and may reactivate malicious payloads unpredictably from compromised sites.
MITRE Techniques
- [T1059] Command and Scripting Interpreter – Uses PowerShell commands to download and execute malicious payloads as part of the infection chain. (‘PowerShell to download a malicious C# project file (.csproj)… execute it using msbuild.exe’)
- [T1105] Ingress Tool Transfer – Downloads payloads from remote servers including the ClearFake controlled URLs hosting secondary scripts and shellcode. (‘downloads the shellcode from a remote server directly into memory’)
- [T1055] Process Injection – Uses Early Bird and Context Hijack injection techniques to inject shellcode into suspended processes. (‘The script performs a shellcode injection routine…using Early Bird and Context Hijack techniques’)
- [T1574] Hijack Execution Flow – Altering CPU context (EIP) of suspended thread to execute injected shellcode. (‘changes the instruction pointer so when resumed it runs the injected shellcode’)
- [T1041] Exfiltration Over C2 Channel – Exfiltrates stolen data to hardcoded command and control servers using HTTP POST requests. (‘malware will submit a POST request with collected data to the hardcoded C2’)
- [T1071] Application Layer Protocol – Uses HTTP and partial HTTPS communications for C2 traffic with obfuscation and encoding. (‘C2 communication using Base64 and XOR encoded JSON structures over HTTP’)
- [T1027] Obfuscated Files or Information – Employs heavy obfuscation including Base64 and XOR encoding in payloads and configuration data. (‘obfuscated PowerShell scripts using XOR encoding and reflection’)
- [T1204] User Execution – Social engineering trick involving fake CAPTCHA and instructions to run commands via Windows Run dialog. (‘fake CAPTCHA prompting users to perform Windows key + R and paste commands’)
- [T1106] Native API – Use of WoW64 syscalls and dynamic resolution of API functions to bypass hooks and evade detection. (‘dynamic API resolution using WoW64 system calls to evade sandbox hooks’)
Indicators of Compromise
- [SHA256] Amatera Stealer samples – 120316ecaf06b76a564ce42e11f7074c52df6d79b85d3526c5b4e9f362d2f1c2, 7d91a585583f4aa1a3ab3cb808d7bc351d6140b3ae1deeef9d51c6414c11baea, and others with variations in HTTPS support.
- [IP Addresses] C2 infrastructure – 104.21.80[.]1 (hardcoded host overplanteasiest[.]top), 172.67.178[.]5 (host header badnesspandemic[.]shop).
- [Domains/URLs] Malicious payload hosts – amaprox[.]icu (C2 HTTPS security), b1[.]talismanoverblown[.]com (C2 and HTTPS), https://cv[.]cbrw[.]ru/t[.]csproj (ClearFake ClickFix payload), https://tt[.]cbrw[.]ru/vb7to8[.]psd (ClearFake second stage PowerShell).
- [Smart Contract Address] ClearFake smart contract on BNB Smart Chain Testnet – 0x80d31D935f0EC978253A26D48B5593599B9542C7.