Excerpt
Key Points
Gen Threat Labs has identified WordlistLoader, a new loader used to deliver Amatera Stealer via ClearFake campaigns.
Amatera has been actively developed over the past few months and has gradually become one of the most prevalent infostealers in our user base.
In this technical blog post, we highlight the changes Amatera has introduced between version 4.0.2 Beta (documented by eSentire) and version 4.3.3-alpha1, the latest version at the time of writing.
Key changes include enhanced static obfuscation, hardened syscall invocation t…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Gen Digital on gendigital.com.
More from Gen Digital3
- Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent DataGen Digital · Published 8 Oct
- VoidStealer: Debugging Chrome to Steal Its SecretsGen Digital · Published 19 Mar
- When Malware Authors Study Algebra: The Group Theory Inside Bedep's DGAGen Digital · Added 6 May
On the same topics
- Vidar v1.5 in Go: same family, new language, heavy sandbox checksderp.ca · Published 16 May
- StealC Is Back, and This Time It's a RATVaronis · Published 22 Oct
- Threat Group Cards: A Threat Actor EncyclopediaETDA Threat Group Cards · Added 25 Oct
- GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub RepositoriesThe Hacker News · Published 19 Oct
