ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager

It sounds like you're describing a sophisticated malware infection chain involving multiple stages of obfuscation and evasion techniques designed to bypass security measures. Here's a summary of the key points:

Malware Components Overview

1. "pf.ch" Loader

   • Type: Packed 32-bit DLL.
   • Exported Function: moor.
   • Imports:
     • AddVectoredExceptionHandler
     • __mb_cur_max
   • Techniques Used:
     • Vectored exception handling
     • XOR loops
     • API hashing
     • Control-flow patterns

2. Amatera Payload

   • Type: 32-bit PE file.
   • Characteristics:
     • No import table.
     • Resolves APIs by walking loaded module export tables.
     • Uses 32-to-64-bit transitions to execute system calls (possibly for EDR evasion).
   • Build Label and Strings:
     • Build label: 4.1.5-alpha
     • String: GETWELLV2
   • C2 Resolution:
     • Resolves C2 server address through a Telegraph page.

Read the full article at Cisco Talos

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.