AmateraStealer

MITRE ATT&CK Mapping ... Resource Development Acquire Infrastructure: VPS T1583.003 VDSINA VPS procurement (17 servers)

MITRE ATT&CK Mapping ... Resource Development Compromise Infrastructure T1584.004 Compromised acecareer.edu WordPress for payload hosting

Attack Chain: From Fake RAM Booster to Full Credential Theft ... Also: ClickFix/FakeCaptcha -> PowerShell (vocals.ps1)

MITRE ATT&CK Mapping ... Initial Access Phishing T1566 ClickFix/FakeCAPTCHA social engineering

MITRE ATT&CK Mapping ... Initial Access Phishing: Spearphishing Link T1566.002 Cracked software download links

Stage 2: The PowerShell Vector (vocals.ps1) ... The dropper forces execution into 32-bit mode via SysWOW64 ... It then XOR-decrypts an embedded .NET assembly

MITRE ATT&CK Mapping ... Execution Native API T1106 ntdll.dll NtCreateThreadEx / NtAllocateVirtualMemory

MITRE ATT&CK Mapping ... Execution User Execution: Malicious File T1204.002 Trojanized Chris-PC RAM Booster installer

The installer bundles a legitimate copy of Chris-PC RAM Booster alongside a malicious DLL. When the user runs the installer ... DLL search order hijacking ensures the malicious payload executes before the real application loads.

Calls NtAllocateVirtualMemory to allocate RWX memory in the current process ... Calls NtCreateThreadEx to spawn a thread executing the shellcode

MITRE ATT&CK Mapping ... Defense Evasion Obfuscated Files T1027 3-layer encryption: XOR -> AES-256-CBC -> RC4

MITRE ATT&CK Mapping ... Defense Evasion Masquerading T1036 Trojanized legitimate RAM Booster installer

Calls NtAllocateVirtualMemory to allocate RWX memory in the current process ... Calls NtCreateThreadEx to spawn a thread executing the shellcode

Heaven's Gate (WoW64 x64 Execution) ... The shellcode uses the Heaven's Gate technique to transition from 32-bit (WoW64) execution context to native 64-bit code ... This defeats 32-bit debuggers and analysis tools

The installer bundles a legitimate copy of Chris-PC RAM Booster alongside a malicious DLL. When the user runs the installer ... DLL search order hijacking ensures the malicious payload executes before the real application loads.

MITRE ATT&CK Mapping ... Credential Access Credentials from Password Stores T1555 Browser, password manager, email client theft

MITRE ATT&CK Mapping ... Credential Access Credentials from Web Browsers T1555.003 Chrome/Firefox/Edge credential extraction

Heaven's Gate (WoW64 x64 Execution) ... The shellcode uses the Heaven's Gate technique to transition from 32-bit (WoW64) execution context to native 64-bit code ... This defeats 32-bit debuggers and analysis tools

MITRE ATT&CK Mapping ... Collection Data from Local System T1005 Document harvesting (DOC/TXT/PDF)

MITRE ATT&CK Mapping ... Command and Control Application Layer Protocol: HTTPS T1071.001 HTTPS C2 on port 443

Dead Drop Resolver: Hiding C2 in Plain Sight ... The attacker creates profiles on Steam Community, Google Docs, Google Slides, or Telegram ... The malware fetches the page ... and decodes the Base64 to obtain the real C2 address

MITRE ATT&CK Mapping ... Command and Control Encrypted Channel T1573.001 AES-256-CBC + RC4 C2 communication

Stolen data is compressed into ZIP archives and exfiltrated via HTTPS POST to https://{C2}/Up/x . Later variants use encrypted endpoints at https://{C2}/enc_Up/x .