> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager - URL: https://f4n6.co.uk/security-feed/clearfake-webdav-infection-chain-delivers-amatera-stealer-zigcryptostealer-and-netsupport-manager/ - Published: 2026-09-08T15:38:43.000Z - Updated: 2026-09-08T15:38:43.000Z - Author: Jeff Davies - Tags: #security-feed, UAT-10820 --- ## 1\. Executive summary Cisco Talos has documented two related infection chains — tracked under loader names "pf.ch" and "verification.google" — that deliver the Amatera credential and cryptocurrency stealer via a ClearFake/ClickFix social-engineering pattern: JavaScript injected into compromised websites by a malicious Cloudflare Worker, with stage code stored on BNB Smart Chain contracts (EtherHiding), culminating in a fake Google CAPTCHA prompt that instructs the victim to paste a WebDAV UNC path into the Windows Run dialog. The WebDAV-hosted DLL is executed via 32-bit `rundll32.exe` with ordinal #1 invocation, and the chains deploy distinct secondary payloads: a BYOVD-based EDR-termination package with the ZigCryptoStealer clipboard-hijacking payload and a Go reverse TCP proxy ("pf.ch" branch), and an unauthorised, silently-configured NetSupport Manager remote-access installation ("verification.google" branch). The initial observation was at a Ukrainian government organisation in April 2026; Talos assesses with moderate confidence the activity is an opportunistic cryptocurrency/credential-stealing operation rather than a targeted attack, and attributes the "verification.google" branch to a Russian threat actor with moderate confidence. Attribution to tracked actor "UAT-10820" is unconfirmed — the actor has no MITRE ATT&CK profile in our verified reference data. For EMEA financial services the bottom-line risk is workstation-level credential theft (password managers, authenticators, mail clients, 100+ wallet locations), followed in one branch by persistent operator-controlled remote access — a combination that can convert a commodity stealer infection into hands-on access to banking sessions and internal systems. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 19: reporting of major ICT-related incidents to competent authorities | The initial detection was at a Ukrainian government organisation, and the "verification.google" branch installs persistent operator-controlled remote access (NetSupport Manager polling a Russia-based gateway every 60 seconds) on an endpoint — a fact pattern that can meet major-incident classification thresholds depending on the affected function and data. | If a client endpoint is confirmed compromised by this chain, the NetSupport persistence and C2 channel must be factored into the DORA Art. 18 classification exercise, and where thresholds are met, the Art. 19 reporting clock applies. | | NIS2 Art. 23: incident reporting obligations | Same distinctive fact: unauthorised remote-access tooling with an operator-controlled channel to Russia-based infrastructure constitutes a significant incident candidate for in-scope entities. | In-scope NIS2 entities should assess this chain's indicators against their estate and, on confirmation, evaluate Art. 23 reporting timelines. | No other article in the regulatory reference is specifically engaged. The third-party/supply-chain articles are not triggered: the delivery vector is compromised public websites and victim-executed commands, not an ICT third-party provider relationship. ## 3\. Technical analysis & attack chain ### Confirmed attack chain ("pf.ch" branch, fully reconstructed by Talos) 1. **Initial access — ClearFake injection.** A malicious Cloudflare Worker injects JavaScript into the content of a compromised website. The injected script queries BNB Smart Chain testnet contract `0x886d310Ac23e05EA705e24E513D19f53793832A9` via `bsc-testnet-rpc[.]publicnode[.]com` — the actor uses the contract as remotely changeable storage for encoded JavaScript (EtherHiding), with the blockchain acting as bulletproof hosting. 2. **Environment checks and stage selection.** The JavaScript checks for local and headless browser environments and identifies the OS. Windows victims retrieve code from contract `0x46790e2Ac7F3CA5a7D1bfCe312d11E91d23383Ff`; macOS victims from `0x68DcE15C1002a2689E19D33A3aE509DD1fEb11A5`. Responses are Base64-decoded and evaluated as JavaScript. 3. **ClickFix social engineering.** The Windows stage creates a victim identifier stored in the `cjs_id` cookie, queries a tracking contract for goal completion, and — if the browser is not headless and the OS is Windows — overlays a fake Google CAPTCHA-style checkbox instructing the victim to open the Windows Run dialog, paste the clipboard contents, and press Enter. 4. **WebDAV execution.** The copied command opens a WebDAV path on a randomised subdomain of `leaguejazire[.]com`, embeds the victim identifier in the path, and executes `pf.ch` via ordinal #1 through 32-bit `rundll32.exe`. The Windows WebClient service starts as part of this execution. 5. **Loader unpacking.** `pf.ch` is a packed 32-bit DLL whose only named export is `moor`; its import table contains only `AddVectoredExceptionHandler` and `__mb_cur_max`. It uses vectored exception handling, XOR loops, API hashing and control-flow obfuscation. A thread waits on an event named `hit`; on trigger it copies an embedded blob to memory and transfers control via Windows fibers. A second-stage decoder uses XOR and LZNT1 to decode the final Amatera payload. 6. **Amatera payload.** A 32-bit PE with no import table that resolves APIs by walking loaded module export tables, and uses 32-to-64-bit transitions to execute system calls (likely to evade EDR hooks). Build label `4.1.5-alpha`; contains the string `GETWELLV2`. The payload was recovered only as a memory-resident artifact and was not observed written to disk. 7. **C2 resolution via dead drop.** The sample constructs the dead-drop URL `hxxps://telegra[.]ph/Functions-04-03` — a Telegraph page disguised as a short Rust programming tutorial titled "Functions." with an altered code example containing `r.]MTQ1LjI0OS4xMDkuMTQ3)0(`. Base64-decoding `MTQ1LjI0OS4xMDkuMTQ3` yields C2 address `145.249.109[.]147`. 8. **C2 session.** Amatera generates WoW64 transition gates, opens an AFD socket, and connects directly to `145.249.109[.]147` on TCP 443\. It calls `GetEndpoints` to obtain randomised URI paths, then retrieves its configuration. Observed traffic framing is consistent with the ECDH and ChaCha20-Poly1305 protocol documented for recent Amatera versions. The configuration is Base64-decoded then XOR-decoded with the key `852149723\x00` before JSON parsing. 9. **Secondary payload deployment.** The configuration's `ld` array drives secondary loaders: `u` \= download URL, `tf` \= payload type, `tr` \= file-based (1) or fileless (2) execution, `p` \= task order. Supported types include executables, DLLs, command scripts, PowerShell, raw shellcode and MSI packages. ### "verification.google" branch (initial detection, upstream stages not directly recovered) - Same WebDAV/rundll32/ordinal-#1 pattern; first export is `CfgInspectModuleData`. Different loader code and protection: it defers unpacking via a work callback registered with the dynamically resolved, undocumented `TpAllocWork` in `ntdll.dll`, executed asynchronously. The callback implements unpacking in a large control-flow-flattening loop. The loader resolves functions by hash, derives execution state from the environment, and implements direct WoW64 syscall stubs that decode syscall numbers at runtime and call the WoW64 transition pointer rather than exported `ntdll.dll` functions. - **Module stomping:** it reconstructs its next stage from `.rdata` data, maps a clean image of legitimate `dbghelp.dll` in memory, overwrites the beginning of its code section with the unpacked stage, restores executable protection, and transfers control to the overwritten region (DLL hollowing/module overloading). - **C2:** this Amatera build stores its bootstrap controller as an encrypted string, decrypts the fixed address `45.150.34[.]2` at runtime, and connects directly on TCP 443 while presenting `github[.]com` as the TLS server name and HTTP Host value (domain fronting-style masquerade). It does not use a public dead-drop resolver. After `GetEndpoints`, it retrieves a configuration with over 400 collection entries. - Talos assesses with **low to medium confidence** that the two delivery chains are identical upstream. **Data collection scope (both branches, from Amatera configuration):** browser data plus Telegram, Signal, WhatsApp and other messaging data; over 100 desktop wallet locations; credentials from password managers, authenticators, FTP clients, mail clients, VPN software and remote-access tools — representative targets include KeePass, Bitwarden, 1Password, RoboForm, NordPass, WinAuth, Authy, FileZilla, AnyDesk, NordVPN and AzireVPN. Four file-grabber rules cover Desktop, Downloads, Documents and Windows Recent-items, with more than 100 filename/extension patterns targeting private keys, wallet backups, API/OAuth material, 2FA data, password databases and certificate files (`.kdbx`, `.p12`, `.pfx`, `.pem`). Collection is heavily weighted to cryptocurrency material and credentials. ### Secondary payload 1 — ZigCryptoStealer + BYOVD EDR termination ("pf.ch", priority 1, file-based) - The `jquery.min.js` task (tf: 1, tr: 1) downloads a ZIP (SHA-256 `279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92`), extracted to a temp directory; the loader enumerates resulting `*.exe` files and launches one. - The archive contains `platform_experience_helper.exe`, a legitimate signed Google Chrome component that imports `GetUserNameExW` from `Secur32.dll` — a malicious DLL in the same archive that gets side-loaded. - The side-loaded `Secur32.dll` is a .NET NativeAOT loader that decrypts and loads two PEs. It starts `C:\Windows\explorer.exe` suspended, manually maps the first PE's headers and sections into the child, changes the initial thread context to the new entry point, and resumes it. - **Payload:** ZigCryptoStealer, a cryptocurrency stealer written in Zig. It polls the clipboard, recognises several cryptocurrency address formats, and replaces matching values with attacker addresses embedded in the payload. - **EtherHiding reuse by the payload:** ZigCryptoStealer makes a JSON-RPC `eth_call` via `bsc[.]rpc[.]blxrbdn[.]com` to BNB Smart Chain contract `0x7CC3cFC1Ac007B8c6566fD2C7419b15a75473468`, disguised as an ERC-20 token-balance query. The contract ignores the supplied address and returns operator-set text; the operator rotates it via `setData(string)`. At analysis time it returned `lb[.]propertyfind[.]cc` as the C2 domain. The contract was deployed 2026-03-16; the deploying wallet made 39 successful `setData` calls through 2026-07-26\. Historical C2 values (all resolving through shared Cloudflare addresses): `fd[.]gstats-api-contact[.]cc` (Jun 30–Jul 5), `pkg[.]vogueatelier[.]cc` (Jul 5–9), `kffd3[.]vogueatelier[.]cc` (Jul 9–12), `kffd3[.]vexlatech[.]cc` (Jul 12–18), `static[.]quorashift[.]cc` (Jul 18–26), `lb[.]propertyfind[.]cc` (Jul 26–30). Cisco Umbrella observed DNS queries for these domains from up to 98 countries (`lb[.]propertyfind[.]cc`), most often from the United States, Indonesia, Brazil, India and Egypt — indicating broad, non-targeted victim distribution. - **BYOVD EDR termination:** the second decrypted PE is a signed Windows driver with version information naming "MOCOMSYS & DCRC" and "DCRCV\_U Driver (for SCM)", original filename `DCRCVDrv.sys`, exposing device `\Device\DCRCVDRV_U`. The NativeAOT loader enumerates running processes, hashes their names against an internal target list of EDR/security tools, and sends matched PIDs to the driver via IOCTL `0x2205c0`. The driver's handler takes the four-byte PID, obtains a handle and calls `ZwTerminateProcess`, with no caller authorisation check — a kernel-mode process-termination primitive. ### Secondary payload 2 — Go reverse TCP proxy ("pf.ch", fileless shellcode) - Shellcode blob SHA-256 `643ef35536ff9273fb84b8504467b1a5645cd3ffd5476d64b99244b02131b205`; walks the PEB to locate `ntdll.dll`, resolves `LdrLoadDll`, `NtAllocateVirtualMemory`, `NtProtectVirtualMemory`, `NtFreeVirtualMemory`, then decrypts (XOR) and decompresses (LZNT1) the final payload, SHA-256 `1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25`. - A 32-bit Golang Windows executable, main package `github.com/acr/proxy-panel/cmd/bot`, including HashiCorp Yamux multiplexing, with hardcoded C2 `wss://update[.]dubbedmuch[.]cc/`. It reads the Windows `MachineGuid` and hostname and sends them over WSS; after C2 acceptance it creates a Yamux server session multiplexing streams over the single connection. Each stream supplies source and destination addresses; the client connects to the requested destination and relays bytes bidirectionally — turning the host into an attacker-controlled reverse proxy. ### Secondary payload 3 — NetSupport Manager installation ("verification.google", fileless PowerShell) - The `ld` task points to `hxxps://kr[.]cedar2glanz[.]ru/jewel[.]js`; tf: 4 identifies PowerShell, tr: 2 selects `DownloadString`/`Invoke-Expression` execution. - The script dynamically resolves native functions, runs environment checks, derives an installation path by hashing `MachineGuid|zdozwoqx3c`, and starts two background PowerShell runspaces requesting many legitimate URLs (GitHub API, npm, Docker Hub, PyPI, NuGet, PowerShell Gallery) as decoy traffic mimicking developer activity. - It downloads `hxxps://phys[.]stunned-amniotic[.]com/hub[.]log` — at analysis time a ZIP, SHA-256 `bd36f4c15fe0acb6748da5ed12e45dcc37d412385812c078d1e4f04730e9f69b`. Note: Talos found no evidence in the Ukrainian victim's logs that this URL was accessed; the file was retrieved by Talos as the likely intended payload — single-sourced reconstruction, verify before enforcement. - The script validates ZIP entry paths, extracts to `%APPDATA%`, launches `hypersnap.exe` without a visible window, and creates a scheduled task triggered at user logon (persistence). - `hypersnap.exe` is a renamed, signed NetSupport Manager 12.44 `client32.exe`, which calls export `_NSMClient32@8` in signed `PCICL32.DLL` (the main NetSupport client runtime). - The actor-controlled `client32.ini` enables silent operation, hides the system-tray interface, disables visible chat/message/disconnect/replay/help controls, and configures `paternal-angrily[.]com:443` as the NetSupport HTTP Gateway. The client polls the gateway every 60 seconds. At analysis time the domain resolved to `212.118.56[.]166`, based in Russia. - The deployment used license name "KAKAN", serial `NSM789508`. Talos notes this exact license file has appeared in numerous malicious NetSupport packages, including activity tracked as EVALUSION and IClickFix — treat it as shared deployment lineage, not a unique actor identifier. - Capability impact: after Amatera's automated collection, NetSupport gives an operator screen and input control, file transfer, inventory, process/service management, and remote command/PowerShell execution — enabling inspection beyond Amatera's predefined rules, use of stolen sessions from the original endpoint, or deployment of additional tooling. **Confidence caveats:** Attribution to actor "UAT-10820" is unconfirmed — no MITRE ATT&CK profile exists in our verified reference data. Talos's moderate-confidence assessment that the "verification.google" branch was conducted by a Russian threat actor rests on the Russia-based NetSupport gateway IP and is single-sourced (Talos only). The linkage of the two delivery chains is assessed by Talos at low-to-medium confidence. The Malwarebytes and Blackpoint Cyber Amatera campaigns share no common infrastructure with these chains beyond the payload family. Censys documented the same Windows/macOS blockchain contracts in a different ClickFix chain with different downstream payloads. ## 4\. Mitigation & containment ### P1 — within 24 hours 1. **Hunt for the WebDAV execution pattern** across the estate: 32-bit `rundll32.exe` (`C:\Windows\SysWOW64\rundll32.exe`) executing a file from a WebDAV UNC path (`\\...\DavWWWRoot\` or `http://`/`https://`\-backed WebDAV), paired with Windows WebClient (`WebClient` service) start events. Any hit on this pattern is a high-fidelity compromise signal for this chain. 2. **Block the observed network infrastructure** at egress/DNS: `leaguejazire[.]com` and all subdomains, `riyazinikokar[.]xyz` (macOS branch), `145.249.109[.]147`, `45.150.34[.]2`, `212.118.56[.]166`, `paternal-angrily[.]com`, `update[.]dubbedmuch[.]cc`, `kr[.]cedar2glanz[.]ru`, `phys[.]stunned-amniotic[.]com`, and the six ZigCryptoStealer C2 domains (`fd[.]gstats-api-contact[.]cc`, `pkg[.]vogueatelier[.]cc`, `kffd3[.]vogueatelier[.]cc`, `kffd3[.]vexlatech[.]cc`, `static[.]quorashift[.]cc`, `lb[.]propertyfind[.]cc`). Note the blockchain-based delivery means stage-one infrastructure is not blocking-friendly — the contracts (`0x886d310Ac23e05EA705e24E513D19f53793832A9`, `0x46790e2Ac7F3CA5a7D1bfCe312d11E91d23383Ff`, `0x68DcE15C1002a2689E19D33A3aE509DD1fEb11A5`, `0x7CC3cFC1Ac007B8c6566fD2C7419b15a75473468`) are only reachable via public RPC endpoints such as `bsc-testnet-rpc[.]publicnode[.]com` and `bsc[.]rpc[.]blxrbdn[.]com`; consider whether those endpoints are business-justified on workstations. 3. **Disable or restrict the WebClient service** on workstations where WebDAV is not a business requirement (`sc config WebClient start= disabled`); this breaks the execution primitive for the entire chain. Where WebDAV is required, restrict it by GPO to approved servers only. 4. **Alert on, and block, the BYOVD driver:** `DCRCVDrv.sys` (device `\Device\DCRCVDRV_U`, IOCTL `0x2205c0`). Add the driver to blocklists if your EDR supports driver blocking; hunt for the device name in kernel telemetry. Any process-termination IOCTL from a user-mode loader to this driver is an EDR-kill attempt in progress. 5. **Hunt for unauthorised NetSupport Manager:** scheduled tasks at user logon launching `hypersnap.exe` from `%APPDATA%`; `client32.ini` referencing `paternal-angrily[.]com`; any `client32.exe`/`PCICL32.DLL` pair outside approved software channels; license serial `NSM789508`. If found, treat the host as operator-accessed, not merely malware-infected — isolate and rebuild. ### P2 — within 72 hours 1. **Hunt clipboard-hijack and proxy persistence:** ZigCryptoStealer is memory-resident via explorer.exe injection — check for explorer.exe child processes or injected modules exhibiting clipboard polling; the Go proxy beacons to `wss://update[.]dubbedmuch[.]cc/` — hunt for outbound WSS from unusual 32-bit Go binaries and Yamux-protocol traffic. 2. **Hunt the decoy-traffic pattern:** bursts of background PowerShell runspaces querying GitHub API, npm, Docker Hub, PyPI, NuGet and PowerShell Gallery from the same host in a short window, especially paired with a `DownloadString`/`IEX` execution. 3. **Hunt the TLS masquerade:** outbound TCP 443 to `45.150.34[.]2` with SNI/Host `github[.]com` — a mismatch between destination IP ownership and presented SNI is the detection signal. 4. **Credential-exposure response:** for any confirmed Amatera execution, assume compromise of browser data, messaging data (Telegram, Signal, WhatsApp), 100+ wallet locations, and credentials from KeePass, Bitwarden, 1Password, RoboForm, NordPass, WinAuth, Authy, FileZilla, AnyDesk, NordVPN, AzireVPN, plus files matching `.kdbx`, `.p12`, `.pfx`, `.pem` and 2FA/API/OAuth material in Desktop, Downloads, Documents and Recent-items. Force password-vault and mailbox credential resets, revoke active sessions and tokens, and re-enrol 2FA. 5. **User awareness:** brief staff on the ClickFix pattern — a browser prompt instructing them to open Run/PowerShell/Terminal and paste clipboard content is never legitimate. This is the sole initial-access gate for the chain; it fails without victim action. ### P3 — within 7 days 1. **EDR coverage review:** confirm your EDR hooks cover WoW64 direct-syscall stubs and 32-to-64-bit transitions; both loaders specifically evade user-mode hooks. Behavioural detection of module stomping (legitimate `dbghelp.dll` code section overwritten post-load) and fiber-based execution should be enabled where supported. 2. **Application control:** block execution of DLLs from WebDAV/UNC paths (WDAC/AppLocker DLL rules covering remote paths), and restrict `rundll32.exe` ordinal-based execution of non-standard extensions. 3. **Blockchain RPC egress:** if workstation access to public BNB Smart Chain RPC endpoints has no business justification, block it — it is used twice in this chain (delivery and payload C2 resolution). ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | -------- | -------------------------------------------------------------------------------------------------- | ---------- | ------ | | domain | leaguejazire\[.\]com (WebDAV loader hosting, randomised subdomains) | High | Talos | | domain | riyazinikokar\[.\]xyz (macOS branch download host) | High | Talos | | ipv4 | 145.249.109\[.\]147 (Amatera C2, pf.ch branch, TCP 443) | High | Talos | | ipv4 | 45.150.34\[.\]2 (Amatera bootstrap C2, verification.google branch, TCP 443, SNI github\[.\]com) | High | Talos | | domain | update\[.\]dubbedmuch\[.\]cc (Go reverse proxy C2, wss) | High | Talos | | domain | kr\[.\]cedar2glanz\[.\]ru (PowerShell secondary payload host) | High | Talos | | domain | phys\[.\]stunned-amniotic\[.\]com (NetSupport ZIP download host) | High | Talos | | domain | paternal-angrily\[.\]com (NetSupport HTTP Gateway, port 443) | High | Talos | | ipv4 | 212.118.56\[.\]166 (NetSupport gateway resolution, Russia-based) | High | Talos | | domain | lb\[.\]propertyfind\[.\]cc (ZigCryptoStealer C2, current at analysis) | High | Talos | | domain | static\[.\]quorashift\[.\]cc (ZigCryptoStealer C2, Jul 18–26) | High | Talos | | domain | kffd3\[.\]vexlatech\[.\]cc (ZigCryptoStealer C2, Jul 12–18) | High | Talos | | domain | kffd3\[.\]vogueatelier\[.\]cc (ZigCryptoStealer C2, Jul 9–12) | High | Talos | | domain | pkg\[.\]vogueatelier\[.\]cc (ZigCryptoStealer C2, Jul 5–9) | High | Talos | | domain | fd\[.\]gstats-api-contact\[.\]cc (ZigCryptoStealer C2, Jun 30–Jul 5) | High | Talos | | url | hxxps://telegra\[.\]ph/Functions-04-03 (Amatera dead-drop resolver) | High | Talos | | url | hxxps://kr\[.\]cedar2glanz\[.\]ru/jewel\[.\]js (PowerShell stage) | High | Talos | | url | hxxps://phys\[.\]stunned-amniotic\[.\]com/hub\[.\]log (NetSupport ZIP) | High | Talos | | sha256 | 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92 (Chrome side-loading ZIP archive) | High | Talos | | sha256 | 643ef35536ff9273fb84b8504467b1a5645cd3ffd5476d64b99244b02131b205 (shellcode blob, Go proxy) | High | Talos | | sha256 | 1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25 (unpacked Go reverse proxy) | High | Talos | | sha256 | bd36f4c15fe0acb6748da5ed12e45dcc37d412385812c078d1e4f04730e9f69b (NetSupport ZIP) | High | Talos | | filename | verification.google (WebDAV DLL loader, export CfgInspectModuleData) | High | Talos | | filename | pf.ch (WebDAV DLL loader, export moor) | High | Talos | | filename | platform\_experience\_helper.exe (legitimate Chrome component, side-load host) | High | Talos | | filename | Secur32.dll (malicious NativeAOT side-loaded DLL) | High | Talos | | filename | dbghelp.dll (legitimate DLL used for module stomping) | High | Talos | | filename | DCRCVDrv.sys (BYOVD driver, device \\Device\\DCRCVDRV\_U) | High | Talos | | filename | hypersnap.exe (renamed NetSupport client32.exe) | High | Talos | | filename | PCICL32.DLL (signed NetSupport runtime) | High | Talos | | filename | client32.ini (NetSupport configuration) | High | Talos | | mutex | hit (event name awaited by pf.ch loader thread) | Medium | Talos | | sha256 | (Amatera memory-resident payload, verification.google branch — see prose) | Medium | Talos | Note on the last row: Talos states the Amatera payload was recovered only as a memory-resident artifact and that its hash is included in their IOC list (published at their GitHub repository, linked in §7), but the hash value itself is not reproduced in the source text provided to us. We do not reproduce hashes we cannot verify verbatim; retrieve it from the Talos GitHub IOC repository. All indicators above are single-sourced (Cisco Talos) — verify before enforcement. ```iocs domain leaguejazire[.]com domain riyazinikokar[.]xyz ipv4 145.249.109[.]147 ipv4 45.150.34[.]2 domain update[.]dubbedmuch[.]cc domain kr[.]cedar2glanz[.]ru domain phys[.]stunned-amniotic[.]com domain paternal-angrily[.]com ipv4 212.118.56[.]166 domain lb[.]propertyfind[.]cc domain static[.]quorashift[.]cc domain kffd3[.]vexlatech[.]cc domain kffd3[.]vogueatelier[.]cc domain pkg[.]vogueatelier[.]cc domain fd[.]gstats-api-contact[.]cc url hxxps://telegra[.]ph/Functions-04-03 url hxxps://kr[.]cedar2glanz[.]ru/jewel[.]js url hxxps://phys[.]stunned-amniotic[.]com/hub[.]log sha256 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92 sha256 643ef35536ff9273fb84b8504467b1a5645cd3ffd5476d64b99244b02131b205 sha256 1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25 sha256 bd36f4c15fe0acb6748da5ed12e45dcc37d412385812c078d1e4f04730e9f69b filename verification.google filename pf.ch filename platform_experience_helper.exe filename Secur32.dll filename dbghelp.dll filename DCRCVDrv.sys filename hypersnap.exe filename PCICL32.DLL filename client32.ini mutex hit ``` ## 6\. Detection ```yara rule Amatera_WebDAV_Loader_pfch { meta: author = "Adverse Trace" date = "2026-09-08" reference = "https://blog.talosintelligence.com/clearfake-webdav-infection-chain/" description = "Detects the pf.ch packed WebDAV loader: single named export 'moor', minimal import table, 'hit' event name" strings: $export = "moor" ascii $imp1 = "AddVectoredExceptionHandler" ascii $imp2 = "__mb_cur_max" ascii $event = "hit" ascii condition: uint16(0) == 0x5a4d and all of them } rule Amatera_Payload_Strings { meta: author = "Adverse Trace" date = "2026-09-08" reference = "https://blog.talosintelligence.com/clearfake-webdav-infection-chain/" description = "Detects Amatera stealer build label and dead-drop resolver artefacts" strings: $build = "4.1.5-alpha" ascii $ddr1 = "GETWELLV2" ascii $ddr2 = "telegra.ph/Functions-04-03" ascii $xor_key = "852149723" ascii condition: uint16(0) == 0x5a4d and 2 of them } rule ZigCryptoStealer_NativeAOT_Loader { meta: author = "Adverse Trace" date = "2026-09-08" reference = "https://blog.talosintelligence.com/clearfake-webdav-infection-chain/" description = "Detects the NativeAOT Secur32.dll side-load loader and BYOVD driver artefacts" strings: $drv1 = "DCRCVDrv.sys" ascii $drv2 = "DCRCV_U Driver (for SCM)" ascii $drv3 = "MOCOMSYS" ascii $dev = "DCRCVDRV_U" ascii condition: 2 of them } ``` ```yaml title: WebDAV DLL execution via 32-bit rundll32.exe - ClearFake/Amatera chain id: 7c1f2a44-8b3e-4d19-9f6a-2e5c8d1b7a30 status: experimental description: Detects execution of a DLL from a WebDAV UNC path through the 32-bit rundll32.exe, the execution primitive of the ClearFake WebDAV / Amatera chain documented by Cisco Talos. references: - https://blog.talosintelligence.com/clearfake-webdav-infection-chain/ tags: - attack.execution - attack.t1204.002 logsource: category: process_creation product: windows detection: selection_rundll32: Image|endswith: '\SysWOW64\rundll32.exe' selection_webdav: CommandLine|contains: - 'DavWWWRoot' - '\\leaguejazire.com\' filter_legitimate: CommandLine|contains: - 'C:\Windows\' condition: selection_rundll32 and selection_webdav and not filter_legitimate falsepositives: - Legitimate WebDAV-based application launches from 32-bit rundll32 (rare; verify path and domain) level: high --- title: Suspicious scheduled task at logon launching hypersnap.exe from AppData - NetSupport Manager install id: 3a9d5c71-2f4b-4e8a-b6c0-9d1e7f3a5b82 status: experimental description: Detects the persistence mechanism of the unauthorised NetSupport Manager deployment in the verification.google branch of the ClearFake/Amatera chain. references: - https://blog.talosintelligence.com/clearfake-webdav-infection-chain/ logsource: category: process_creation product: windows detection: selection_task: ParentCommandLine|contains|all: - 'schtasks' - 'logon' selection_target: CommandLine|contains|all: - '\AppData\' - 'hypersnap.exe' condition: 1 of them falsepositives: - HyperSnap screenshot tool legitimately installed per-user (verify signer and client32.ini presence) level: high ``` ## 7\. Sources - Cisco Talos, "ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager", https://blog.talosintelligence.com/clearfake-webdav-infection-chain/, 2026-09-08 ## 8\. Adverse Trace position This is a high-impact commodity chain with an escalation path that matters to financial services: broad, non-targeted distribution (Umbrella DNS queries from up to 98 countries) via a social-engineering gate that requires only one careless paste action, followed by memory-resident credential and wallet theft at scale, and — in the "verification.google" branch — persistent, operator-controlled remote access through a silently configured NetSupport Manager client polling Russia-based infrastructure every 60 seconds. The BYOVD EDR-termination capability means clients should not assume their endpoint agent survives an infection of the "pf.ch" branch; detection must lean on the WebDAV execution pattern, network IOCs, and behavioural signals rather than trusting the EDR process itself post-compromise. Attribution is unconfirmed: the tracked actor UAT-10820 has no MITRE ATT&CK profile in our verified reference data, and Talos's Russian-actor assessment for the "verification.google" branch is moderate-confidence and single-sourced. All IOCs in this advisory derive from a single vendor report — verify before enforcement actions such as wholesale domain blocks. We will monitor the Talos GitHub IOC repository for the memory-derived Amatera hash, track the ZigCryptoStealer contract (`0x7CC3cFC1Ac007B8c6566fD2C7419b15a75473468`) for new `setData` rotations, and update clients if the two chains are confirmed identical or if additional Amatera delivery chains sharing this infrastructure emerge. --- [Read the original source →](https://blog.talosintelligence.com/clearfake-webdav-infection-chain/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*