--- analysis: 'A single rule on telegra.ph resolution is too noisy. This hunt uses a phased approach: scoping by infrastructure, corroborating via memory-evasion indicators (module activity), and confirming via behavioral theft patterns (file activity). Only the agent''s consolidated read provides high-confidence confirmation.' blind_spots: - id: incomplete-telemetry question: whether the module stomping occurred on unmanaged hosts requires: endpoint agent on all devices risk: A host without the hb_module_activity surface cannot be assessed for DLL hollowing, leading to false negatives. stage: stealthy-loader-evasion - id: memory-resident-evasion question: the presence of the final Amatera payload requires: memory scanning risk: Amatera is memory-resident; a negative result on hb_file_activity does not prove the absence of the stealer if it was never written to disk. stage: stealthy-loader-evasion coverage: - stage: stealthy-loader-evasion status: covered steps: - loader-hollowing-dbghelp - stage: amatera-c2-resolution status: covered steps: - telegraph-c2-resolution - stage: credential-and-crypto-theft status: covered steps: - cryptocurrency-wallet-access - stage: secondary-payload-deployment status: covered steps: - secondary-payload-activity - reason: Belongs to another part of the 'ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager' series. stage: clearfake-etherhiding-delivery status: out_of_scope - reason: Belongs to another part of the 'ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager' series. stage: clickfix-social-engineering status: out_of_scope - reason: Belongs to another part of the 'ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager' series. stage: webdav-rundll32-execution status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: keep-as-periodic-hunt justification: Amatera targets high-value cryptocurrency and identity assets. Its use of module stomping and dead-drop resolution makes traditional rule-based detection difficult. A phased hunt that correlates early infection with follow-on theft is necessary to confirm the full intrusion chain. methodology: model-assisted trigger: intel-report hypothesis: An intruder has deployed the Amatera stealer, characterized by DLL hollowing of dbghelp.dll and dead-drop C2 resolution via Telegraph, and is now scanning for cryptocurrency wallets or deploying secondary payloads like ZigCryptoStealer. labels: - hunt - attack.t1574.002 - attack.t1059.001 - attack.t1555 - attack.t1115 - attack.t1218.011 name: Amatera Stealer and Follow-on Payloads parameters: c2_domains: default: - telegra.ph - leaguejazire.com - riyazinikokar.xyz - verification.google - pf.ch description: Domains used for dead-drop resolution and command-and-control. from: kind: article observed: '2026-09-08' ref: talos type: list[domain] lookback_days: default: '14' description: Days of history to examine. from: kind: manual observed: '2026-09-08' ref: default type: number scope_hosts: default: [] description: Optional list of hostnames to focus the hunt; leave empty to scan the entire estate. from: kind: manual observed: '2026-09-08' ref: default type: list[host] secondary_payload_names: default: - client32.exe - secur32.dll description: Process and module names associated with secondary payloads. from: kind: article observed: '2026-09-08' ref: talos type: list[string] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://blog.talosintelligence.com/clearfake-webdav-infection-chain/ gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: The hunt should start with endpoints communicating with telegra.ph. If no matches are found, broaden the scope to servers and workstations running rundll32.exe with unusually high module activity. references: - name: "Talos \u2014 ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer,\ \ and NetSupport Manager" url: https://blog.talosintelligence.com/clearfake-webdav-infection-chain/ related: - hunt: webdav-rundll32-execution reason: The initial delivery mechanism (WebDAV UNC paths and rundll32 ordinals) is handled by a separate hunt focused on delivery. relation: out-of-scope-alternative scenario: stages: - name: EtherHiding via BNB Smart Chain observables: - bsc-testnet-rpc.publicnode.com - '0x886d310Ac23e05EA705e24E513D19f53793832A9' - '0x46790e2Ac7F3CA5a7D1bfCe312d11E91d23383Ff' - '0x68DcE15C1002a2689E19D33A3aE509DD1fEb11A5' slug: clearfake-etherhiding-delivery tactic: initial-access techniques: - T1059.001 - name: ClickFix Fake CAPTCHA Overlay observables: - cjs_id cookie - Fake Google CAPTCHA UI - Run dialog clipboard paste prompt slug: clickfix-social-engineering tactic: execution - name: WebDAV DLL Execution observables: - rundll32.exe - leaguejazire.com - pf.ch - verification.google - 'ordinal #1' - WebClient service start slug: webdav-rundll32-execution tactic: execution techniques: - T1218.011 - name: DLL Hollowing and VEH Unpacking observables: - dbghelp.dll module hollowing - Vectored Exception Handling (VEH) - LZNT1 decoding - WoW64 syscall stubs - TpAllocWork function callback slug: stealthy-loader-evasion tactic: defense-evasion techniques: - T1574.002 - name: Amatera Dead Drop C2 Resolution observables: - telegra.ph/Functions-04-03 - 145.249.109.147 - GETWELLV2 string - Auxiliary Function Driver (AFD) socket slug: amatera-c2-resolution tactic: command-and-control - name: Credential and Wallet Collection observables: - Browser credential store access - Cryptocurrency wallet directory scanning - Clipboard monitoring slug: credential-and-crypto-theft tactic: credential-access techniques: - T1555 - T1115 - name: Secondary Payload Installation observables: - secur32.dll sideloading - NetSupport Manager - ZigCryptoStealer - riyazinikokar.xyz slug: secondary-payload-deployment tactic: persistence techniques: - T1574.002 - T1059.001 summary: The ClearFake campaign utilizes EtherHiding via BNB Smart Chain and social engineering through fake Google CAPTCHA overlays to trick users into executing malicious commands. These commands trigger a WebDAV-based DLL execution via rundll32.exe, deploying the Amatera stealer which subsequently installs secondary payloads like ZigCryptoStealer and NetSupport Manager. series: index: 2 slug: clearfake-webdav-infection-chain-delivers-amatera-stealer-zigcryptostealer-and-netsupport-manage title: ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager total: 2 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent web: category: siem name: Web server / proxy logs telemetry: - network tlp: clear type: investigation --- # Amatera Stealer and Follow-on Payloads This hunt identifies the post-infection lifecycle of the Amatera stealer, focusing on its specific evasion and persistence techniques. Amatera often employs module stomping (DLL hollowing) in dbghelp.dll to hide its memory-resident payload and resolves its C2 server via encoded strings on Telegraph pages. Once established, the stealer scans the host for browser credentials and cryptocurrency wallet directories. The hunt uses a phased approach: first scoping the estate for early infection signals, then pivoting to identify evidence of theft and the deployment of secondary payloads like NetSupport Manager or ZigCryptoStealer. ## scope-hosts-by-dns Identify endpoints that have resolved the reported C2 or dead-drop domains to focus the search. ```sqlite target=endpoint role=scoping params=(c2_domains=c2_domains, lookback_days=lookback_days) ~~~yaml expected: A list of hostnames communicating with reported infrastructure. Silence suggests the C2 is not currently active via these domains. reads: - device_hostname - query_hostname - time silence: not_evidence_of_absence source: hb_dns_activity verified: dry-run verified_at: '2026-09-28' ~~~ SELECT DISTINCT device_hostname FROM hb_dns_activity WHERE (instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## parallel-early-infection parallel: - → loader-hollowing-dbghelp - → telegraph-c2-resolution join: → agent-early-triage ## loader-hollowing-dbghelp Detect the overwriting of legitimate modules, specifically targeting dbghelp.dll in rundll32 processes. ```sqlite target=endpoint role=triage params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: Instances of rundll32 loading dbghelp.dll. While legitimate, their combination in a transient process is an indicator of module stomping. reads: - device_hostname - process_name - module_name - module_path - time silence: not_evidence_of_absence source: hb_module_activity verified: dry-run verified_at: '2026-09-28' ~~~ SELECT device_hostname, process_name, module_name, module_path, time FROM hb_module_activity WHERE LOWER(module_name) = 'dbghelp.dll' AND LOWER(process_name) LIKE '%rundll32.exe' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## telegraph-c2-resolution Identify HTTP requests to the dead-drop pages used to resolve the C2 server IP. ```sqlite target=web role=triage params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: HTTP requests to specific URIs on telegra.ph. Silence proving the dead-drop has not been accessed using these known paths. reads: - device_hostname - url_hostname - url_path - time silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-09-28' ~~~ SELECT device_hostname, url_hostname, url_path, time FROM hb_http_activity WHERE LOWER(url_hostname) = 'telegra.ph' AND (LOWER(url_path) LIKE '/functions-%' OR LOWER(url_path) LIKE '/getwell%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## agent-early-triage ```agent target=hunter cite: required context: - loader-hollowing-dbghelp - telegraph-c2-resolution max_iterations: 3 objective: Determine which hosts show early Amatera behavior, specifically the hollowing of dbghelp.dll or Telegraph C2 resolution. success_criteria: A list of hosts with confirmed or suspicious loader presence. tools: - endpoint - web ``` ## parallel-follow-on parallel: - → cryptocurrency-wallet-access - → secondary-payload-activity join: → agent-follow-on-triage ## cryptocurrency-wallet-access Find unusual processes accessing wallet directories or browser data. ```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Unusual processes reading wallet files. Stack-counting helps isolate theft from normal browser updates. prevalence: by: device_hostname key: - file_path rare_below: 3 reads: - device_hostname - process_name - file_path - time silence: not_evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-09-28' ~~~ SELECT device_hostname, process_name, file_path, COUNT(*) AS access_count, MIN(time) AS first_access FROM hb_file_activity WHERE (instr(LOWER(file_path), 'wallets') > 0 OR instr(LOWER(file_path), 'atomic') > 0 OR instr(LOWER(file_path), 'exodus') > 0 OR LOWER(file_name) = 'login data') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, file_path HAVING access_count < 50 ``` ## secondary-payload-activity Detect secondary tools deployed by the Amatera loader, such as NetSupport Manager or sideloaded modules. ```sqlite target=endpoint role=detection-candidate params=(secondary_payload_names=secondary_payload_names, lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: NetSupport (client32.exe) or sideloaded ZigCrypto components running from user-writable paths. Absence suggests secondary payloads have not yet been deployed. reads: - device_hostname - process_name - process_cmd_line - parent_process_name - time silence: not_evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-09-28' ~~~ SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (instr(',' || '{{secondary_payload_names}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(',' || '{{secondary_payload_names}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0) AND (LOWER(process_path) LIKE '%\appdata\%' OR LOWER(process_path) LIKE '%\users\public\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## agent-follow-on-triage ```agent target=hunter cite: required context: - agent-early-triage - cryptocurrency-wallet-access - secondary-payload-activity max_iterations: 4 objective: 'Determine if any host shows the complete lifecycle of Amatera: loader mechanics, C2 resolution, wallet access, and secondary payload deployment.' success_criteria: A per-host verdict citing specific rows from all behavioral surfaces. tools: - endpoint - web ``` ## decision-route if~: "the agent-follow-on-triage verdict is malicious or suspicious for at least one host" (confidence: high, judge=hunter) then: → isolate-host indeterminate: → analyst-review unavailable: → analyst-review (blind_spot: incomplete-telemetry) else: → close-out ## isolate-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host identified by the agent and block all traffic to 145.249.109.147. ``` → analyst-review ## analyst-review ```manual target=analyst Review the cited module activity for dbghelp.dll hollowing and verify the process tree of any wallet access events. ``` → close-out ## close-out ```manual target=analyst Summarize findings and document any observed secondary payload paths for detection engineering. ``` → end