Amatera Stealer: Rebranded ACR Stealer With Improved Evasion, Sophistication

Impact

For European organizations, Amatera Stealer poses a considerable risk primarily through the theft of credentials and sensitive data from browsers and cryptocurrency wallets. This can lead to unauthorized access to corporate accounts, financial theft, and potential lateral movement within networks if stolen credentials are reused. The malware’s ability to execute secondary payloads increases the risk of follow-on attacks such as ransomware or espionage. Given the widespread use of browsers and crypto wallets in Europe, especially in financial, technology, and governmental sectors, the impact could include financial losses, reputational damage, and regulatory penalties under GDPR for data breaches.

The stealthy communication and evasion techniques make detection and response more difficult, potentially allowing prolonged unauthorized access. The MaaS model lowers the barrier for less skilled attackers to deploy this malware, increasing the likelihood of widespread infections. European organizations with remote or hybrid work environments may be particularly vulnerable due to increased exposure to web-based attack vectors. Additionally, the targeting of crypto wallets is relevant given the growing adoption of cryptocurrencies in Europe, including in countries like Germany, the Netherlands, and Switzerland.

Defensive guidance

1. Implement advanced endpoint detection and response (EDR) solutions capable of detecting WoW64 syscall anomalies and unusual process injection behaviors. 2. Monitor network traffic for suspicious use of non-standard socket communications such as NTSockets, and enforce strict egress filtering to block unauthorized outbound connections, especially to known malicious domains like those identified (e.g., "amaprox.icu"). 3. Harden browsers by disabling or restricting the use of stored credentials and cookies where possible, and enforce multi-factor authentication (MFA) to reduce the impact of stolen credentials. 4. Educate users about the risks of phishing and web injects, emphasizing safe browsing practices and the dangers of interacting with suspicious websites. 5. Regularly audit and monitor cryptocurrency wallet usage and implement hardware wallets or cold storage solutions to protect high-value assets. 6. Employ application allowlisting to prevent execution of unauthorized secondary payloads. 7. Keep all software and security tools updated to detect emerging variants and employ threat intelligence feeds to block known indicators of compromise (IOCs) such as hashes and domains associated with Amatera Stealer. 8. Conduct regular incident response drills focusing on detection and containment of information stealers to improve organizational readiness.