8 minhigh
ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager
ClearFake WebDAV chain uses BNB Smart Chain-hosted JavaScript and fake CAPTCHA prompts to deliver Amatera stealer, ZigCryptoStealer, and NetSupport Manager via DLL sideloading and hollowing. Two parallel ClearFake delivery chains use WebDAV UNC paths and rundll32 ordinal execution to launch Amatera stealer DLLs. The pf.ch branch deploys ZigCryptoStealer via Chrome DLL sideloading and a BYOVD driver to kill EDR; the verification.google branch installs unauthorized NetSupport Manager for persistent remote access.
Sens:■ Immediate
IOCs31
14domain5url4filename4sha2563ip1file path
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Block listed C2 IPs and domains at network firewall and DNS resolver
- Isolate and investigate hosts with rundll32.exe executing from WebDAV paths
- Block WebDAV UNC path execution via Group Policy for non-essential systems
- Hunt for scheduled tasks referencing executables in %APPDATA%
Key Takeaways
- Amatera build 4.1.5-alpha uses Steam community profiles and Telegraph as dead-drop C2 resolvers
- BNB Smart Chain contracts store delivery JavaScript and ZigCryptoStealer C2 configuration via EtherHiding
- DCRCVDrv.sys driver terminates EDR processes via IOCTL 0x2205c0 without caller authorization checks
- NetSupport Manager uses shared license serial NSM789508 seen in EVALUSION and IClickFix campaigns
- Amatera configuration targets over 100 wallet locations and credential stores including KeePass, Bitwarden, 1Password
Attack Chain
- Initial Access: Compromised website injects ClearFake JS via Cloudflare Worker from BNB Smart Chain
- Execution: Fake CAPTCHA tricks user into running WebDAV UNC path, launching DLL via rundll32 ordinal #1
- Defense Evasion: DLL hollowing of dbghelp.dll; BYOVD driver terminates EDR; WoW64 direct syscalls
- C2: Amatera resolves C2 via Telegraph dead-drop or hardcoded IP over TCP 443
- Collection: Steals browser data, wallets, credentials from 100+ apps including KeePass and Bitwarden
- Persistence: NetSupport Manager installed via scheduled task; ZigCryptoStealer hollowed into explorer.exe
Affected Systems
- Windows endpoints (32-bit rundll32.exe used for DLL execution)
- macOS endpoints (separate delivery branch identified)
- Web browsers (ClearFake JavaScript injection target)
- BNB Smart Chain (used as bulletproof hosting for malicious code)
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | BYOVD terminates EDR; WoW64 syscalls and API hashing evade hooks, but process ancestry and file operations remain visible. |
| Network Visibility | Medium | C2 uses TCP 443 with TLS and legitimate SNI; blockchain RPC and DNS queries to attacker domains are observable. |
| Detection Difficulty | Hard | Multiple evasion layers including BYOVD, DLL hollowing, blockchain hosting, and encrypted C2 require layered detection. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| rundll32.exe executing DLLs from WebDAV UNC paths with ordinal parameters (T1218.001) | Process creation with network path arguments | Execution | Low — rare in enterprise environments |
| Processes making JSON-RPC eth_call requests to BNB Smart Chain contracts for C2 config retrieval (T1105) | DNS queries to BSC RPC endpoints and HTTP POST to contract addresses | Command and Control | Medium — legitimate blockchain development activity |
| Scheduled tasks creating entries for executables in %APPDATA% with renamed binaries (T1053.005) | Windows Task Scheduler event logs | Persistence | Low — atypical path for scheduled tasks |
| Signed drivers terminating security tool processes via IOCTL without caller authorization checks (T1562.001) | Driver load events and process termination correlation | Defense Evasion | Low — specific IOCTL and driver signature |
Required Log Sources
- Process creation events (Sysmon EID 1)
- Network connections (Sysmon EID 3)
- DNS query logs
- File creation events (Sysmon EID 11)
- Driver load events (Sysmon EID 6)
- Scheduled task creation (EID 4698)
Key Behavioral Indicators
- rundll32.exe with WebDAV UNC path and ordinal #1 argument
- conhost.exe --headless spawning cmd.exe with variable obfuscation
- dbghelp.dll loaded in rundll32.exe process context
- DCRCVDrv.sys driver load followed by security tool process terminations
- hypersnap.exe in %APPDATA% with scheduled task at logon
- AMSI_RESULT_NOT_DETECTED string in PowerShell process memory
Control Gaps
- Network-only detection misses memory-resident Amatera payload
- BYOVD bypasses EDR process protection before telemetry can alert
- Blockchain-hosted C2 config evades domain blocklists
- TLS with legitimate SNI github.com bypasses SSL inspection
- Decoy PowerShell traffic masks malicious downloads
False Positive Assessment
Low — WebDAV DLL execution via rundll32 with ordinals is rare; blockchain RPC queries from browsers may generate false positives.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Block outbound traffic to BNB Smart Chain RPC endpoints on corporate networks
- Enable TLS inspection for traffic presenting github.com SNI to non-GitHub IPs
- Deploy driver block rules for DCRCVDrv.sys and untrusted signed drivers
- Restrict WebClient service startup to required systems only
User Protection
- Deploy EDR with behavioral detection for DLL hollowing and module stomping
- Block execution of DLLs from WebDAV UNC paths via application control
- Enable AMSI for PowerShell to catch AMSI_RESULT_NOT_DETECTED bypass attempts
- Monitor for clipboard content replacement with cryptocurrency addresses
Security Awareness
- Train users to recognize fake CAPTCHA verification prompts requesting Win+R
- Warn users never to paste clipboard content into Run dialog from web pages
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping30 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
Credential Access
Tactic
Lateral Movement
Tactic
Collection
Plain-Language Summary
Attackers compromise websites to show fake CAPTCHA verification prompts that trick users into running malicious code via the Windows Run dialog. The code downloads stealers that take cryptocurrency wallets, passwords, and messaging app data from over 100 applications. A second stage can install remote access software for ongoing control. Organizations should block the listed domains and IPs and train users to recognize fake verification prompts.
Additional IOCs
- Domains:
riyazinikokar[.]xyz- macOS delivery domain for pf.ch branchfd[.]gstats-api-contact[.]cc- ZigCryptoStealer historical C2 (June 30 to July 5)pkg[.]vogueatelier[.]cc- ZigCryptoStealer historical C2 (July 5 to 9)kffd3[.]vogueatelier[.]cc- ZigCryptoStealer historical C2 (July 9 to 12)kffd3[.]vexlatech[.]cc- ZigCryptoStealer historical C2 (July 12 to 18)static[.]quorashift[.]cc- ZigCryptoStealer historical C2 (July 18 to 26)estimator-undermostshelving[.]in[.]net- Amatera secondary payload delivery domainstunned-amniotic[.]com- NetSupport Manager ZIP download domaincedar2glanz[.]ru- PowerShell payload domain for NetSupport installdemobunfiber[.]top- Amatera C2 host header for pf.ch branch
- Urls:
hxxps://kr[.]cedar2glanz[.]ru/jewel.js- PowerShell payload for NetSupport installationhxxps://phys[.]stunned-amniotic[.]com/hub.log- NetSupport Manager ZIP download URLhxxps://geo[.]estimator-undermostshelving[.]in[.]net/dc06681a3f4e- Amatera secondary payload download URLhxxps://geo[.]estimator-undermostshelving[.]in[.]net/jquery.min.js- Amatera NativeAOT ZIP payload download URL
- File Hashes:
643ef35536ff9273fb84b8504467b1a5645cd3ffd5476d64b99244b02131b205(SHA256) - Go reverse TCP proxy shellcode blob1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25(SHA256) - Unpacked Go reverse proxy executable
- File Paths:
secur32.dll- Malicious NativeAOT sideloaded DLLDCRCVDrv.sys- Vulnerable driver for EDR process terminationplatform_experience_helper.exe- Legitimate Chrome component used for DLL sideloading%APPDATA%\hypersnap.exe- Renamed NetSupport Manager client32.execlient32.ini- Actor-controlled NetSupport Manager config for silent operation
- Command Lines:
- Purpose: Push WebDAV path to clipboard and execute DLL via rundll32 | Tools:
conhost.exe,cmd.exe,rundll32.exe| Stage: Execution |conhost --headless cmd /v:on /c - Purpose: Download and execute PowerShell payload for NetSupport installation | Tools:
powershell.exe| Stage: Execution |powershell DownloadString | IEX
- Purpose: Push WebDAV path to clipboard and execute DLL via rundll32 | Tools:
- Other:
0x886d310Ac23e05EA705e24E513D19f53793832A9- BNB Smart Chain contract storing initial ClearFake JavaScript0x46790e2Ac7F3CA5a7D1bfCe312d11E91d23383Ff- BNB Smart Chain contract for Windows delivery stage0x68DcE15C1002a2689E19D33A3aE509DD1fEb11A5- BNB Smart Chain contract for macOS delivery stage0x7CC3cFC1Ac007B8c6566fD2C7419b15a75473468- BNB Smart Chain contract for ZigCryptoStealer C2 configNSM789508- NetSupport Manager license serial shared across campaignsGETWELLV2- Amatera build label used as Steam profile for C2 resolution
Showing defanged values
- domaincedar2glanz[.]ruPowerShell payload domain for NetSupport install
- domaindemobunfiber[.]topAmatera C2 host header for pf.ch branch
- domainestimator-undermostshelving[.]in[.]netAmatera secondary payload delivery domain
- domainfd[.]gstats-api-contact[.]ccZigCryptoStealer historical C2 (June 30 to July 5)
- domainkffd3[.]vexlatech[.]ccZigCryptoStealer historical C2 (July 12 to 18)
- domainkffd3[.]vogueatelier[.]ccZigCryptoStealer historical C2 (July 9 to 12)
- domainlb[.]propertyfind[.]ccZigCryptoStealer current C2 domain from smart contract
- domainleaguejazire[.]comWebDAV delivery domain for pf.ch branch
- domainpaternal-angrily[.]comNetSupport Manager HTTP gateway domain
- domainpkg[.]vogueatelier[.]ccZigCryptoStealer historical C2 (July 5 to 9)
- domainriyazinikokar[.]xyzmacOS delivery domain for pf.ch branch
- domainstatic[.]quorashift[.]ccZigCryptoStealer historical C2 (July 18 to 26)
- domainstunned-amniotic[.]comNetSupport Manager ZIP download domain
- domainupdate[.]dubbedmuch[.]ccGo reverse TCP proxy C2 over WebSocket Secure
- filenameclient32.iniActor-controlled NetSupport Manager config for silent operation
- filenameDCRCVDrv.sysVulnerable driver for EDR process termination
- filenameplatform_experience_helper.exeLegitimate Chrome component used for DLL sideloading
- filenamesecur32.dllMalicious NativeAOT sideloaded DLL
- file_path%APPDATA%\hypersnap.exeRenamed NetSupport Manager client32.exe
- ip145[.]249[.]109[.]147Amatera C2 server for pf.ch branch on TCP 443
- ip212[.]118[.]56[.]166NetSupport Manager gateway IP based in Russia
- ip45[.]150[.]34[.]2Amatera C2 server for verification.google branch
- sha2561819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25Unpacked Go reverse proxy executable
- sha256279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92ZIP archive with Chrome DLL sideloading package
- sha256643ef35536ff9273fb84b8504467b1a5645cd3ffd5476d64b99244b02131b205Go reverse TCP proxy shellcode blob
- sha256bd36f4c15fe0acb6748da5ed12e45dcc37d412385812c078d1e4f04730e9f69bNetSupport Manager ZIP archive payload
- urlhxxps://geo[.]estimator-undermostshelving[.]in[.]net/dc06681a3f4eAmatera secondary payload download URL
- urlhxxps://geo[.]estimator-undermostshelving[.]in[.]net/jquery[.]min[.]jsAmatera NativeAOT ZIP payload download URL
- urlhxxps://kr[.]cedar2glanz[.]ru/jewel[.]jsPowerShell payload for NetSupport installation
- urlhxxps://phys[.]stunned-amniotic[.]com/hub[.]logNetSupport Manager ZIP download URL
- urlhxxps://telegra[.]ph/Functions-04-03Telegraph dead-drop resolver for Amatera C2 IP