WordlistLoader

Amatera being distributed via ClearFake campaigns leveraging FakeCaptchas... FakeCaptchas are served through compromised, legitimate websites, via injected malicious JavaScripts that overlay a fake CAPTCHA verification on top of the real website.

The clipboard commands follow a consistent pattern: they use conhost to launch a hidden cmd process, map a remote WebDAV share using pushd, and finally invoke the Run export of the downloaded DLL (WordlistLoader) via rundll32.

map a remote WebDAV share using pushd, and finally invoke the Run export of the downloaded DLL (WordlistLoader) via rundll32.

Once the visitor clicks on the "I'm not a robot" checkbox, they're walked through the well-known ClickFix flow, where a malicious command is copied into their clipboard and the victim is instructed to paste it into the Windows Run dialog and execute it.

the loader proceeds to reconstruct the shellcode, which is stored in encoded form as a sequence of plain English words, with each word representing exactly one byte... we also identified a modified version... in which the wordlist is replaced with an array of UUIDs

Unhooking of all loaded modules... compares the first instruction of each named export with the corresponding instruction in a clean copy read from disk... Whenever a hook is detected, the loader computes the length of the offending jump and restores the original bytes from the clean copy.

Rebuilding the shellcode thus comes down to iterating over the word sequence, looking up each word in the list, and writing the index of the matching entry into the output buffer.

The clipboard commands follow a consistent pattern... and finally invoke the Run export of the downloaded DLL (WordlistLoader) via rundll32.

The shellcode begins with a NOP sled, followed by an anti-emulation stub whose sole purpose, apart from burning time, is to repeatedly patch a single byte... each of the 254 patches is preceded by the delay loop of 16,777,215 (0xFFFFFF) iterations

Finally, execution is transferred to the decrypted code... and hands control over to a reflective loader responsible for unpacking and loading Amatera.

The second defense-evasion mechanism employed by WordlistLoader is a hardware-breakpoint-based ETW (Event Tracing for Windows) bypass, which comes down to setting a hardware breakpoint on ntdll!NtTraceEvent and registering a vectored exception handler.

The shellcode begins with a NOP sled, followed by an anti-emulation stub whose sole purpose, apart from burning time, is to repeatedly patch a single byte... each of the 254 patches is preceded by the delay loop of 16,777,215 (0xFFFFFF) iterations

The second defense-evasion mechanism employed by WordlistLoader is a hardware-breakpoint-based ETW (Event Tracing for Windows) bypass, which comes down to setting a hardware breakpoint on ntdll!NtTraceEvent and registering a vectored exception handler.

The second defense-evasion mechanism employed by WordlistLoader is a hardware-breakpoint-based ETW (Event Tracing for Windows) bypass... Execution therefore never reaches the body of NtTraceEvent, so the event is never logged.