AmateraMalware
Amatera is a stealer written in C++. It conducts anti-sandbox analysis before enumerating browsers, exfiltrating found cryptocurrency files/wallets and possibly credentials.From MISP Galaxy
Last reported 17 days ago, by ESET WeLiveSecurity (ES)7 reports
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1684Social Engineering
“From a social engineering perspective, Doug recommends considering which events in your work or personal life would genuinely require you to drop everything and respond immediately.”
- T1053.005Scheduled Task
“The HTA created a scheduled task, launched 32-bit PowerShell, disabled AMSI, and calculated a victim-specific subdomain based on the computer name and username.”
- T1219Remote Access Tools
“…desktop wallet locations and credential data from password managers, authenticators, FTP clients, mail clients, VPN software, and remote-access tools.”
- T1003.001LSASS Memory
“They might use Mimikatz, comsvcs.dll, direct access to LSASS memory, a custom utility or another implementation entirely.”
- T1119Automated Collection
“NetSupport adds an operator driven capability after Amatera’s automated collection.”
- T1547.014Active Setup
“… trojanized installer that drops an infostealer, a Node.js implant, and a batch script that establishes persistence through a Windows Active Setup registry key.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
7 reports, newest first · the exact sentence from each-
Amatera: qué es y cómo funciona el infostealer que lidera las detecciones en América Latina“Amatera: qué es y cómo funciona el infostealer que lidera las detecciones en América Latina”
-
Panorama de ciberamenazas en América Latina: balance del primer semestre de 2026“… basados en estándares FIDO2/WebAuthn para mitigar el impacto del robo o filtración de credenciales por infostealers como Amatera y AgentTesla.”
-
The Fine Art of Frustrating the Adversary“Vanja encountered this while analyzing two attack chains that used the Amatera information stealer as their primary payload.”
-
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures“The DLL payload initiates a multi-stage process to drop Amatera Stealer.”
-
HBO Max ads on a compromised Reddit account exposed a massive PasteSwitch ClickFix operation“The Windows Branch: InstallFix and Amatera”
-
We've got one word for it, and it's usually the wrong one“Attributed to a Russian threat actor tracked as UAT-10820, the campaign delivers the Amatera stealer alongside secondary payloads like ZigCryptoStealer and NetSupport Manager.”
-
ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager“ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager”
Indicators in its reports
named in the reports above- 9f1f11a708d393e0…06f18ffcc507in 1 report
- 2915b3f8b703eb744fc54c81f4a9c67fin 1 report
- w32.9f1f11a708-100.sbx[.]tgin 1 report
- 9896a6fcb9bb5ac1…66decd6a4a7fin 1 report
- 38de5b216c33833af710e88f7f64fc98in 1 report
- c4dd71e347a076ba…942ba2ab16b2in 1 report
- 9a47c4d379998ade2f8f99e23a630c06in 1 report
- w32.c4dd71e347-95.sbx[.]tgin 1 report
- 90b1456cdbe6bc27…e389a49d3d59in 1 report
- c2efb2dcacba6d3ccc175b6ce1b7ed0ain 1 report
- 5bb86c1cd08fe5e1…b9e10897f811in 1 report
- f3e82419a43220a7a222fc01b7607adcin 1 report
- verification[.]googlein 1 report
- pf[.]chin 1 report
- leaguejazire[.]comin 1 report
- riyazinikokar[.]xyzin 1 report
- hxxps://telegra[.]ph/Functions-04-03in 1 report
- 145.249.109[.]147in 1 report
- 45.150.34[.]2in 1 report
- 279d04c0cfd700c8…772739aecb92in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.