Amatera Stealer 4.0.2 Beta: What’s New in This Variant

Summary

Amatera Stealer 4.0.2 Beta is a reworked C++ information stealer that has been marketed as Malware-as-a-Service since 2018. This updated version introduces stronger anti-debugging and anti-analysis capabilities, includes geofencing checks tied to Kaspersky products and Ukrainian keyboard layouts, and replaces AES-256-CBC with an ECDH key exchange combined with ChaCha20-Poly1305 for command-and-control encryption. Its collection modules have also expanded to target additional cryptocurrency wallets and browser extensions, while adding support for harvesting Discord and Signal artifacts. Delivery relies on a ClickFix mshta.exe chain that deploys a 32-bit shellcode loader, which reflectively injects the stealer directly into memory.

Investigation

The eSentire Threat Response Unit observed the full delivery chain in a finance-sector environment in April 2026. Their analysis identified a 32-bit shellcode loader that resolved seven core APIs, decrypted its payload using a 128-byte XOR key, decompressed it with aPLib, and performed reflective PE injection. The loader also implemented the RecycledGate and FreshyCalls syscall resolution method together with encryption of syscall numbers. Configuration data was delivered over HTTPS through an ECDH-based key exchange protected by ChaCha20-Poly1305, and access to the configuration required a hard-coded GUID.

Mitigation

Defenders should block mshta.exe execution for files retrieved from untrusted URLs and disable the Run dialog through Group Policy where possible. Application control tools such as AppLocker or WDAC should be used to prevent unauthorized PowerShell and HTA execution. Security teams should also monitor for known Kaspersky driver paths and checks for Ukrainian keyboard layouts, as these may indicate evasion behavior. Endpoint protection should be capable of detecting reflective injection techniques and loaders that rely on API hashing.

Response

If Amatera Stealer activity is detected, isolate the affected system immediately, stop the malicious process, and collect memory dumps for key and payload analysis. Capture decrypted TLS traffic where possible to recover configuration details and identify any exfiltrated data. A full review of credentials and cryptocurrency wallets present on the host should be conducted. Organizations should also launch indicator-based hunting across the environment using the reported IOCs and related attacker techniques.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An attacker who has obtained PowerShell execution on a compromised host wishes to exploit a Kaspersky driver‑evasion bug. They use PowerShell’s New-Item cmdlet to drop four decoy driver files (klif.sys, kldisk.sys, klhk.sys, kneps.sys) into C:WindowsSysWOW64drivers. By doing so they generate the exact command‑line strings that the Sigma rule matches, thereby provoking an alert while also planting files that could be leveraged for later privilege‑escalation or persistence.

• Regression Test Script:

  # PowerShell script to create the four decoy Kaspersky driver files.
  $driverPath = "C:WindowsSysWOW64drivers"
  $files = @("klif.sys","kldisk.sys","klhk.sys","kneps.sys")
  
  foreach ($f in $files) {
      $fullPath = Join-Path -Path $driverPath -ChildPath $f
      try {
          New-Item -Path $fullPath -ItemType File -Force -ErrorAction Stop |
              Out-Null
          Write-Host "[+] Created $fullPath"
      } catch {
          Write-Warning "[-] Failed to create $fullPath : $_"
      }
  }

• Cleanup Commands:

  # Remove the created decoy driver files to restore the host to its original state.
  $driverPath = "C:WindowsSysWOW64drivers"
  $files = @("klif.sys","kldisk.sys","klhk.sys","kneps.sys")
  
  foreach ($f in $files) {
      $fullPath = Join-Path -Path $driverPath -ChildPath $f
      if (Test-Path $fullPath) {
          Remove-Item -Path $fullPath -Force
          Write-Host "[+] Removed $fullPath"
      }
  }