MalwarePublished 21 Aug 2025Updated 20 Sep 2025

New Variant of ACRStealer Actively Distributed with Modifications

Source AlienVault OTX General

Description

A modified version of the ACRStealer infostealer is being actively distributed, featuring enhanced detection evasion and analysis obstruction techniques. The malware uses the Heaven's Gate technique for executing x64 code in WoW64 processes and implements low-level NT functions for C2 communications. It employs domain disguising, self-signed certificates, and data encryption. Recent variants have introduced random string paths for exfiltration and changed the configuration request method. ACRStealer, now rebranded as AmateraStealer, can steal sensitive information from various sources and install additional malware. The ongoing feature updates make it one of the most active infostealer variants, posing a significant threat to users.

Impact

For European organizations, the presence of AmateraStealer can lead to severe confidentiality breaches, as the malware targets sensitive information such as credentials and system data. This can result in unauthorized access to corporate networks, intellectual property theft, and potential financial fraud. The ability to install additional malware increases the risk of ransomware deployment or lateral movement within networks, potentially disrupting business operations and causing reputational damage. Given the malware's sophisticated evasion techniques, traditional endpoint detection and network monitoring solutions may struggle to identify infections promptly, leading to prolonged dwell time and increased damage. The medium severity rating reflects the significant but not immediately catastrophic impact; however, the stealth and persistence of the malware elevate the risk over time. European organizations handling sensitive personal data under GDPR are particularly vulnerable to regulatory penalties if breaches occur. The threat also complicates incident response efforts due to its anti-analysis features and encrypted communications, potentially delaying containment and remediation.

Defensive guidance

To effectively mitigate the threat posed by AmateraStealer, European organizations should implement a multi-layered defense strategy tailored to its advanced evasion techniques. First, deploy endpoint detection and response (EDR) solutions capable of monitoring low-level system calls and cross-architecture execution behaviors, including detection of Heaven's Gate technique usage. Network security appliances should be configured to inspect encrypted traffic where feasible, employing SSL/TLS interception with strict privacy considerations to detect domain disguising and anomalous C2 communications. Implement strict application whitelisting and restrict execution of unsigned or self-signed binaries, combined with robust code-signing policies. Regularly update threat intelligence feeds with the provided malware hashes and IP indicators to enable proactive blocking and detection. Conduct frequent user awareness training focused on phishing and social engineering, as initial infection vectors often rely on user interaction. Employ behavioral analytics to identify unusual file path creations and random string patterns indicative of exfiltration attempts. Finally, maintain comprehensive backup and recovery plans, and ensure rapid incident response capabilities to contain infections swiftly. Collaboration with national cybersecurity centers and sharing of threat intelligence within industry sectors can enhance collective defense against this evolving threat.

Indicators of compromise

IP addresses 5

178.130.47.243
185.100.159.193
185.76.243.208
185.76.243.214
85.208.139.75

Hashes 14

047135bc4ac5cc8269cd3a4533ffa846
09825dd40ba8ba3c1ce240e844d650a8
20fb6cc7760289d09071f6bbba6ac591
248faa2393653779e971b8d54abd3b4c
2d57b9b630bb9ca18b9f14387febb843
3c33cd6452930af3486628400df300e64d22d34c
6df10e71da80fdbbca104390e3657a6c4e491fe3
c112707dc426200f5baea78d00137783a5dc3199
f9fdc4046b226e3ff470b9f086d2102754485383
7640fed98a53856641763683163f4127b9fc00f9a788773c00ee1f2634cec82f

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 21 Aug 2025, 20:21 UTC

MITRE ATT&CK techniques15 from threat tags

Technical details

Indicators of compromise

IP addresses 5

Hashes 14

Community reviews

Related threats