AhnLab’s Security Intelligence Center (ASEC) has issued a warning about the return of one of the dangerous infostealers – ACRStealer, which has “evolved” and changed its name to AmateraSealer.
​

Once available at the beginning of the year, ACRStealer has now undergone a comprehensive upgrade with the ability to hide, bypass surveillance, communicate untraceably, and steal sensitive data. This is a serious threat, especially to individual users and small businesses, who often have little in-depth defenses.

ACRStealer is sophisticated information – stealing software that uses DDR, Google Docs and Steam techniques for remote (C2) control. It possesses detection evasion, HTTP traffic control using low-level techniques such as NtCreateFile, along with domain name and IP tampering operations to jam network surveillance systems. The new versions use AES-256 encryption, actuators and stochastics to increase concealment. The mechanism of spreading includes stealing cryptocurrency wallet data, login information, sensitive documents, and the ability to extend the attack through sub-payloads. More recently, the ACRStealer variant has been renamed AmateraTealer, which retains the characteristics of being one of the most powerful and fast – adapting information – stealing software lines.
​

How ACRStealer Works: Before you know it, everything’s stolen.

1. Subtle Hiding with Heaven’s Gate

The new version uses a technique called Heaven’s Gate, which allows malicious code to run 64-bit shellcode in a 32-bit process on Windows. This makes regular surveillance software very difficult to detect, as the malicious activity is completely hidden

2. Do not use normal libraries, use the core of the operating system

Unlike many malicious codes that use WinHTTP or Winsock to connect to the control server (C2), ACRStealer communicates directly over the system driver (AFD) using low – level commands such as NtCreateFile and NtDeviceIoControlFile. This can help bypass firewalls, network surveillance systems, or anti-malware software based on surveillance APIs.

3. Camouflage the real address with “trusted domain name”

To distract the examiner, the reader code pretends to contact reputable websites such as microsoft.com, google.com and facebook.com but actually connects to other malicious IP addresses. The surveillance system sees all these “clean addresses,” so it’s easy to miss them.

What did ACRStealer steal?

The new version also encrypted all data sent to C2 using the AES-256 standard, with the encryption key and initialization string (IV) embedded in the malicious code file. Each victim is given a unique endpoint, making it even harder to detect using traditional methods.

With its wide-ranging capabilities of evasion, customization, and information theft, AmateraStealer is currently one of the most dangerous and difficult-to-spot infostealers in the world. It is being distributed mainly through:

A report from ProofPoint confirms AmateraStealer is among the most heavily distributed information-stealing malware today.
​

What does a user need to do to protect themselves?

ACRStealer’s return and comprehensive upgrades show increasingly sophisticated and persistent hackers. You don’t need to be a jerk, but if you slip up a few simple things, like a wrong click or a wrong installation, you may have “hidden” all of your personal data to the wrong person.

WhiteHat​