ClearFake Campaigns Use WordlistLoader to Deploy Amatera

Summary

A newly identified loader called WordlistLoader is being used in ClearFake campaigns to distribute the Amatera infostealer. The loader reconstructs shellcode from encoded English words or UUIDs, helping it evade conventional detection. Amatera has also evolved with advanced evasion techniques, including Heaven’s Gate for syscalls and hijacked thread pools for browser injection.

Investigation

The investigation examined the infection chain beginning with compromised websites displaying fake CAPTCHA prompts. Researchers analyzed WordlistLoader’s execution process, including module unhooking, ETW bypass through hardware breakpoints, and shellcode decoding from wordlists. The research also covered Amatera version 4.3.3-alpha1, highlighting its updated Application-Bound Encryption bypass and hardened syscall implementation.

Mitigation

Organizations should implement clipboard protections to reduce the risk of malicious commands delivered through social engineering. EDR solutions should be capable of detecting hardware breakpoint manipulation and ETW bypass attempts. Security teams should also monitor unusual process behavior, including conhost launching hidden cmd processes that use pushd to map remote WebDAV shares.

Response

If the described command patterns are detected, the affected host should be isolated immediately to prevent further data exfiltration. Responders should perform memory forensics to identify injected shellcode or hijacked browser threads. Unauthorized WebDAV connections should also be investigated, along with endpoint logs that can reveal the source of the malicious command.

Simulation Execution

Attack Narrative & Commands: The adversary seeks to deliver the Amatera infostealer while minimizing the footprint on the host. They initiate a hidden command prompt via conhost.exe --headless. Once the shell is established, the attacker uses the pushd command to mount a remote WebDAV share (simulated via a local UNC path for testing purposes) to avoid the noise of net use. Finally, they execute the malicious component by calling rundll32.exe against a DLL located on that newly mapped drive, specifically invoking the Run export to begin the infection chain.

• Regression Test Script:

  # Simulation script for Amatera/WordlistLoader pattern
  # Note: We use a local folder to simulate a UNC path to avoid actual network dependency in a lab.
  
  $fakeWebDavPath = "\$env:COMPUTERNAMEC$TempMaliciousShare"
  if (!(Test-Path $fakeWebDavPath)) { New-Item -Path $fakeWebDavPath -ItemType Directory -Force }
  
  # Create a dummy DLL to satisfy the rundll32 requirement
  # In a real scenario, this would be the actual Amatera payload.
  $dummyDll = "$fakeWebDavPathpayload.dll"
  New-Item -Path $dummyDll -ItemType File -Force
  
  # The Trigger Command: 
  # This command is structured to match the Sigma rule's selection criteria:
  # 1. Uses conhost.exe with --headless
  # 2. Contains cmd, pushd, rundll32, ,Run, and \
  
  $cmdPayload = "cmd.exe /c pushd $fakeWebDavPath && rundll32.exe $fakeWebDavPathpayload.dll,Run"
  
  # Start the process via conhost to trigger the specific detection logic
  Start-Process "conhost.exe" -ArgumentList "--headless", $cmdPayload

• Cleanup Commands:

  # Remove the simulated malicious directory and dummy files
  $fakeWebDavPath = "\$env:COMPUTERNAMEC$TempMaliciousShare"
  if (Test-Path $fakeWebDavPath) {
      Remove-Item -Path $fakeWebDavPath -Recurse -Force
  }