Gen Threat Labs identified WordlistLoader, a new loader used in ClearFake campaigns to deliver Amatera Stealer through fake CAPTCHA and ClickFix-style infection chains. The report also details major Amatera changes through version 4.3.3-alpha1, including stronger obfuscation, WoW64/Heaven’s Gate syscall hardening, x64 syscall trampolines, and a redesigned Application-Bound Encryption bypass. #WordlistLoader #AmateraStealer #ClearFake #FakeCaptchas #ClickFix #HeavensGate #WoW64 #PoolParty
Keypoints
- Gen Threat Labs discovered WordlistLoader as a new intermediate loader in the infection chain delivering Amatera Stealer.
- ClearFake campaigns use compromised legitimate websites to display fake CAPTCHA prompts and trick victims into running malicious commands.
- The copied command typically launches conhost and cmd, maps a remote WebDAV share, and executes WordlistLoader through rundll32.
- WordlistLoader reconstructs shellcode from encoded English words, and a variant uses UUIDs to encode 16-byte chunks.
- The loader includes defense-evasion features such as unhooking loaded modules, a single-instance check, and an ETW bypass using a hardware breakpoint and VEH.
- Amatera has evolved significantly from version 4.0.2 Beta to 4.3.3-alpha1, adding heavier static obfuscation, hardened WoW64 syscall paths, and runtime-built x64 syscall trampolines.
- Amatera’s Application-Bound Encryption bypass was revamped to resemble Remus/Lumma, including memory scanning for browser key material and thread-pool hijacking via PoolParty variant 7.
MITRE Techniques
- [T1055 ] Process Injection – Amatera injects into browser processes to decrypt keys and execute payload logic, using remote mappings and browser thread-pool hijacking (‘injecting a payload into the browser process’ / ‘hijacks the browser’s thread pool’).
- [T1055.002 ] Portable Executable Injection – The payload is mapped into the browser and executed there via section mapping and callback-based execution (‘maps each twice, once locally and once in the browser’).
- [T1053.005 ] Scheduled Task/Job: Scheduled Task – The browser thread pool is abused with a queued work item to execute attacker-controlled code (‘queues a TP_DIRECT work item on it’).
- [T1106 ] Native API – The loader and stealer rely on direct Windows API/NTDLL calls such as NtTraceEvent, NtProtectVirtualMemory, NtCreateSection, and NtMapViewOfSection (‘resolving the syscall numbers on its own’).
- [T1620 ] Reflective Code Loading – Decompiled shellcode hands control to a reflective loader that unpacks and loads Amatera (‘hands control over to a reflective loader responsible for unpacking and loading Amatera’).
- [T1140 ] Deobfuscate/Decode Files or Information – WordlistLoader reconstructs shellcode from English words, and Amatera decrypts strings and encrypted blobs (‘reconstruct the shellcode’, ‘each string is now stored as a ciphertext blob’).
- [T1027 ] Obfuscated Files or Information – Amatera uses control-flow flattening, indirect control flow, API hashing, and string obfuscation to hinder analysis (‘control-flow flattening and indirect control-flow obfuscation’).
- [T1562.001 ] Impair Defenses: Disable or Modify Tools – WordlistLoader bypasses ETW logging by setting a hardware breakpoint and redirecting execution (‘the event is never logged’).
- [T1112 ] Modify Registry – Not mentioned.
- [T1057 ] Process Discovery – WordlistLoader enumerates loaded modules to detect hooks (‘enumerates loaded modules with CreateToolhelp32Snapshot’).
- [T1218.011 ] Rundll32 – The malicious command launches the downloaded DLL via rundll32 (‘rundll32 … ,Run’).
- [T1204.001 ] User Execution: Malicious Link – Victims are manipulated through fake CAPTCHA and ClickFix instructions to execute the payload themselves (‘paste it into the Windows Run dialog and execute it’).
- [T1105 ] Ingress Tool Transfer – The infection chain downloads WordlistLoader and then Amatera through staged delivery (‘leading to the download of WordlistLoader’).
- [T1001 ] Data Obfuscation – The shellcode and strings are encoded with wordlists, UUIDs, and encrypted blobs to hide payload content (‘encoded form as a sequence of plain English words’).
- [T1068 ] Exploitation for Privilege Escalation – Not mentioned.
Indicators of Compromise
- [Domains/URLs ] Compromised websites serving ClearFake FakeCaptchas – abogadosrosarinos[.]com, aptisweb[.]com, avene-hebergement[.]com, https-xhamster[.]com, caesarjaco[.]co[.]id/jasa-pengiriman-hewanskybap[.]shop
- [Domains ] WordlistLoader delivery infrastructure used in clipboard commands – shop-nitrilean[.]com, shop-thyrafemmebalance[.]com
- [File names ] Downloaded DLL payloads executed by rundll32 – gmwmvymdzgqgptwvbslq.dll, azjsbxanuofzndqtmtlv.dll
- [SHA-256 hashes ] WordlistLoader samples – eb883ff84700245a199dfbe120c3c2012b2dbf1ec97b26721fbda3ee7445c85a, 9a2d02fa59501e1438f852250c4fdb24086d8a0184ece32240091f91515bbf7d, and 3 more hashes
- [SHA-256 hashes ] Amatera samples and variants – 9a969110c055c3f48af75ce8d2b75c2e7b898a4519a700c7a0cd1fcbc993ecad, 7b8c30af2ca566927fb91e08c33ebb92089e86afb70d74715e5c7d8de6f9ecfc, and 8 more hashes
- [C2 domains ] Amatera command-and-control infrastructure – health[.]luminexus[.]cc, stream[.]luminfrastructure[.]cc, stream[.]threatenbrick[.]cc, yw[.]enhanceblabber[.]cc, pmpo[.]cloudvector[.]cc, and other 7 domains
- [Dead-drop URLs ] Content hosting used by Amatera – telegra[.]ph/Executing-modules-as-scripts-06-16, telegra[.]ph/Using-Python-as-a-Calculator-06-05, and 4 more URLs