WordlistLoader Delivers Amatera Stealer in ClearFake Campaigns
Summary
Gen Threat Labs analyzes ClearFake fake-CAPTCHA/ClickFix chains delivering Amatera via WordlistLoader, detailing shellcode decoding and evasion plus Amatera 4.3.3-alpha1’s syscall hardening and Application-Bound Encryption bypass.
Key points
- ClearFake injects fake CAPTCHA prompts into compromised legitimate websites and uses ClickFix instructions to trick visitors into running a copied command.
- The command launches hidden processes, maps a remote WebDAV share, and runs the downloaded WordlistLoader DLL through rundll32.
- WordlistLoader reconstructs shellcode from encoded English words; a variant uses UUIDs. The shellcode proceeds to a reflective loader that loads Amatera.
- WordlistLoader checks for a single instance, restores hooked module code, and bypasses ETW logging using a hardware breakpoint and vectored exception handler.
- Compared with version 4.0.2 Beta, Amatera 4.3.3-alpha1 adds heavier obfuscation, hardened WoW64 syscall handling, and runtime-built x64 syscall trampolines.
- Amatera’s Application-Bound Encryption bypass scans browser memory for protected key material and injects a payload into the browser.
- The report says Amatera launches that payload by hijacking the browser’s thread pool using PoolParty variant 7.
Article Details
- Attack Vectors
- ClearFake injects malicious JavaScript into compromised legitimate websites to display fake CAPTCHA prompts and guide visitors through a ClickFix flow.
- Victims are instructed to paste a clipboard command into the Windows Run dialog. The command launches a hidden cmd process through conhost, maps a remote WebDAV share, and runs the downloaded WordlistLoader DLL with rundll32.
- WordlistLoader reconstructs shellcode from encoded English words or UUIDs, then hands execution to a reflective loader that loads Amatera.
- WordlistLoader evades analysis by unhooking loaded modules and bypassing ETW logging with a hardware breakpoint and vectored exception handler.
- Amatera scans browser memory for protected browser key material, maps payload sections into the browser, and queues a TP_DIRECT work item on the browser thread pool to execute the payload.
- Defensive Notes
- Gen Digital says it proactively defends against fake-CAPTCHA attacks that rely on users executing copied commands with Clipboard protection.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | app-api[.]lensstory[.]cc | Domain listed as Amatera command-and-control infrastructure. |
| DOMAIN | dist[.]runtimeconsole[.]cc | Domain listed as Amatera command-and-control infrastructure. |
| DOMAIN | dust[.]packetflow[.]cc | Domain listed as Amatera command-and-control infrastructure. |
| DOMAIN | health[.]luminexus[.]cc | Domain listed as Amatera command-and-control infrastructure. |
| DOMAIN | id[.]binaryharbor[.]cc | Domain listed as Amatera command-and-control infrastructure. |
| DOMAIN | id[.]exhumepacifier[.]cc | Domain listed as Amatera command-and-control infrastructure. |
| DOMAIN | pmpo[.]cloudvector[.]cc | Domain listed as Amatera command-and-control infrastructure. |
| DOMAIN | proxy[.]fluxautomation[.]cc | Domain listed as Amatera command-and-control infrastructure. |
| DOMAIN | shop-nitrilean[.]com | Delivery domain used in clipboard commands to map a remote WebDAV share for WordlistLoader. |
| DOMAIN | shop-thyrafemmebalance[.]com | Delivery domain used in a clipboard command to map a remote WebDAV share for WordlistLoader. |
| DOMAIN | stream[.]luminfrastructure[.]cc | Domain listed as Amatera command-and-control infrastructure. |
| DOMAIN | stream[.]pawpalace[.]cc | Domain listed as Amatera command-and-control infrastructure. |
| DOMAIN | stream[.]threatenbrick[.]cc | Domain listed as Amatera command-and-control infrastructure. |
| DOMAIN | updates[.]wildtrail[.]cc | Domain listed as Amatera command-and-control infrastructure. |
| DOMAIN | wss[.]infrastructurecore[.]cc | Domain listed as Amatera command-and-control infrastructure. |
| DOMAIN | yw[.]enhanceblabber[.]cc | Domain listed as Amatera command-and-control infrastructure. |
| SHA256 | 124f2104ca9ee75a99aa998bb016c202f43b890d0173213846fa2495db7fa0d7 | SHA-256 hash of a WordlistLoader sample. |
| SHA256 | 7b8c30af2ca566927fb91e08c33ebb92089e86afb70d74715e5c7d8de6f9ecfc | SHA-256 hash of an Amatera 4.3.3-alpha1 sample. |
| SHA256 | 84ffddad7e2eb1f476b857321b0cd54a7a283dbdb82bd3a13ea1b49862595d20 | SHA-256 hash of a WordlistLoader sample. |
| SHA256 | 9a2d02fa59501e1438f852250c4fdb24086d8a0184ece32240091f91515bbf7d | SHA-256 hash of a UUID-encoding WordlistLoader variant. |
| SHA256 | 9a969110c055c3f48af75ce8d2b75c2e7b898a4519a700c7a0cd1fcbc993ecad | SHA-256 hash of an Amatera 4.3.3-alpha1 sample. |
| SHA256 | 9f3c2d1f150516edcdc274c3791f4e8301807b479ddf796fc019bc910054e3a1 | SHA-256 hash of a WordlistLoader sample. |
| SHA256 | cd598cea811d8f73ca7afffa40e5963be9a82e01bad8ffcebb104b475c091faa | SHA-256 hash of a WordlistLoader sample. |
| SHA256 | eb883ff84700245a199dfbe120c3c2012b2dbf1ec97b26721fbda3ee7445c85a | SHA-256 hash of a WordlistLoader sample. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationAmatera uses control-flow and indirect-control-flow obfuscation, API hashing, and encrypted string blobs to hinder analysis.T1055 · Process InjectionAmatera maps a payload into a browser process and executes it there as part of its Application-Bound Encryption bypass.T1105 · Ingress Tool TransferThe clipboard command maps a remote WebDAV share to access and execute the staged WordlistLoader DLL.T1106 · Native APIAmatera resolves syscall numbers and invokes native system calls, including through WoW64 and runtime-built x64 syscall trampolines.T1140 · Deobfuscate/Decode Files or InformationWordlistLoader reconstructs shellcode from encoded words or UUIDs, and Amatera decrypts obfuscated strings and data.T1204.004 · Malicious Copy and PasteThe fake CAPTCHA flow instructs victims to copy and paste a command into the Windows Run dialog and execute it.T1218.011 · Rundll32The victim-executed command uses rundll32 to invoke the downloaded WordlistLoader DLL's Run export.T1562.006 · Indicator BlockingWordlistLoader uses a hardware breakpoint and vectored exception handler to prevent calls to NtTraceEvent from logging events.T1620 · Reflective Code LoadingWordlistLoader's decrypted code transfers execution to a reflective loader that unpacks and loads Amatera.
People
Malware
ACR (AcridRain) StealerOver the past few months, Amatera Stealer (also often referred to as ACR Stealer) has been actively developed and has gradually become one of the most prevalent infostealer in our user base.Amatera StealerGen Threat Labs identified WordlistLoader, a new loader used in ClearFake campaigns to deliver Amatera Stealer through fake CAPTCHA and ClickFix-style infection chains.WordlistLoaderGen Threat Labs identified WordlistLoader, a new loader used in ClearFake campaigns to deliver Amatera Stealer through fake CAPTCHA and ClickFix-style infection chains.
Products
Google ChromeThese are precisely the five bytes the mask excludes from the comparison, which Amatera leaves zeroed out, while Remus keeps the values from whichever chrome.dll build the pattern was lifted from.Microsoft Windows[T1106 ] Native API – The loader and stealer rely on direct Windows API/NTDLL calls such as NtTraceEvent, NtProtectVirtualMemory, NtCreateSection, and NtMapViewOfSection (‘resolving the syscall numbers on its own’).