Amatera Stealer Adds Evasion Features and Expands Credential and Wallet Theft
Summary
eSentire analyzes Amatera Stealer delivered through a ClickFix chain, detailing its shellcode loader, stronger C2 encryption, anti-analysis techniques, and expanded theft of browser, messaging, wallet, and Downloads-folder data.
Key points
- eSentire intercepted an attempted Amatera Stealer delivery in a finance-industry customer environment in late April 2026 and isolated the affected host.
- The infection chain starts with ClickFix and uses multiple PowerShell stages to run shellcode that decrypts and decompresses the stealer in memory.
- The loader uses reflective injection, API hashing, and optional PE-header erasure; the malware adds XTEA string encryption and anti-debug and sandbox checks.
- C2 communications now use an ECDH key exchange with NIST P-256 and ChaCha20-Poly1305, preventing decryption from a network capture alone without key material from memory.
- Harvesting has expanded to more browsers and cryptocurrency wallets, plus Discord, Signal attachments, and files in the Downloads directory.
- The researchers provide YARA rules and IOCs; eSentire says it is developing detection content and recommends restricting mshta.exe and using endpoint detection and response.
Article Details
- Attack Vectors
- The attack chain begins with ClickFix and uses mshta.exe to retrieve a dropper from hxxps://download.version-516[.]com/other.
- Several PowerShell stages execute an encoded command and ultimately run 32-bit shellcode in memory; the shellcode decrypts and decompresses the Amatera Stealer payload.
- Amatera Stealer harvests browser and wallet data, Discord and Signal data, and files of interest from the victim's Downloads directory.
- The malware communicates with its C2 over HTTP, establishing a session with an ECDH NIST P-256 key exchange and encrypting subsequent data with ChaCha20-Poly1305.
- Defensive Notes
- The eSentire team isolated the affected host and assisted the customer with remediation.
- Disable mshta.exe using AppLocker GPO or Windows Defender Application Control (WDAC).
- Consider disabling the Run prompt through Group Policy and provide security-awareness training using scenarios such as fake software downloads.
- Use endpoint detection and response or next-generation antivirus; the article also recommends 24/7 managed detection and response coverage.
- Avoid storing cryptocurrency seed phrases, private keys, passwords, or other sensitive data unencrypted on disk.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | compactedtightness[.]cfd | Amatera Stealer C2 domain listed in the Indicators of Compromise table. |
| DOMAIN | oakenfjrod[.]ru | Second-stage dropper domain identified in the Indicators of Compromise table. |
| IPV4 | 77[.]91[.]97[.]244 | Amatera Stealer C2 address listed in the Indicators of Compromise table. |
| SHA256 | 534460224e1140ca7f512daea7258a9fce40dc0daef6994d79d08bdf4ce3e4b8 | Hash of the HTA dropper identified in the Indicators of Compromise table. |
| SHA256 | e913fa5b2dd0a7fc3dbaf0a6f882b3ead9a58511bd945b6e5c478cbd2b900508 | Hash of the Amatera shellcode loader. |
| SHA256 | ec1206989449d30746b5ceb2b297cda9f3f09636a0e122ecafb40b1dc2e86772 | Hash of the unpacked Amatera Stealer. |
| URL | hxxps[:]//download[.]version-516[.]com/other | Dropper URL identified in the Indicators of Compromise table. |
MITRE ATT&CK
T1027.007 · Dynamic API ResolutionThe shellcode and Amatera resolve APIs by walking export tables and matching hashed export names.T1059.001 · PowerShellThe attack chain uses multiple PowerShell stages, including execution of an encoded command.T1497.001 · System ChecksAmatera checks for sandbox or virtual-machine processes and uses installed-program and process counts as environment-evasion checks.T1620 · Reflective Code LoadingThe shellcode loader decrypts and decompresses the payload, maps its sections into memory, resolves imports, and transfers execution to its entry point.T1622 · Debugger EvasionAmatera checks debugger-related process fields and hardware breakpoints, and attempts to hide its main thread from debuggers.
People
Malware
ACR (AcridRain) Stealerwithin a customer environment in the Finance industry. Amatera Stealer is a rebranded version of ACR (AcridRain) Stealer, a C++ based information stealer previously marketed as Malware-as-a-Service (MaaS) onAmatera StealerIn late April 2026, eSentire's Threat Response Unit (TRU) intercepted an attempted delivery of Amatera Stealer within a customer environment in the Finance industry. Amatera Stealer is a rebranded version of ACR
Vendors
eSentireIn late April 2026, eSentire's Threat Response Unit (TRU) intercepted an attempted delivery of Amatera Stealer within a customer environment in the Finance industry. Amatera Stealer is a rebranded version of ACRKasperskyAnti-debug, anti-analysis features have been added, and geofencing to ensure the malware doesn't execute on systems with Kaspersky installed or Ukraine keyboard layout
Products
1PasswordPassword manager file globs broadened for Bitwarden, 1Password, RoboForm, and NordPassAppLockerDisable mshta.exe via AppLocker GPO or Windows Defender Application Control (WDAC):C:\Windows\System32\mshta.exeBitwardenPassword manager file globs broadened for Bitwarden, 1Password, RoboForm, and NordPassDiscordDiscord harvesting added; Signal harvesting expandedKasperskyAnti-debug, anti-analysis features have been added, and geofencing to ensure the malware doesn't execute on systems with Kaspersky installed or Ukraine keyboard layoutMicrosoft WindowsPEB fields OSMajorVersion and OSMinorVersion, ensuring LdrpHandleTlsData is only called on hosts running Windows 8.1 or higher. TLS callbacks are then invoked (if any).NordPassPassword manager file globs broadened for Bitwarden, 1Password, RoboForm, and NordPassPerplexity CometBrowser targets nearly doubled (37 to 65), including the AI browser Perplexity Comet, privacy browsers, and Asian-market Chromium forksPowerShellThe attack chain begins with ClickFix and leads to several stages of PowerShell that ultimately execute 32-bit shellcode that decrypts, decompresses, and executes Amatera Stealer in memory (in the context of PowerShell).RoboFormPassword manager file globs broadened for Bitwarden, 1Password, RoboForm, and NordPassSignalDiscord harvesting added; Signal harvesting expandedWindows Defender Application ControlDisable mshta.exe via AppLocker GPO or Windows Defender Application Control (WDAC):C:\Windows\System32\mshta.exe