APT / THREAT GROUP

Amatera

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Amatera is a stealer written in C++. It conducts anti-sandbox analysis before enumerating browsers, exfiltrating found cryptocurrency files/wallets and possibly credentials.

Threat Analysis

Amatera is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://bazaar.abuse.ch/sample/73fd51d4a0959e5c5a82db9be0d765069d02a2b97f51f55f5d6422a7bec01caa/

→https://blackpointcyber.com/blog/novel-fake-captcha-chain-delivering-amatera-stealer/

→https://cip.gov.ua/services/cm/api/attachment/download?id=71278

→https://github.com/VenzoV/MalwareAnalysisReports/blob/main/AmateraStealer/Amatera%20Stealer%20v1.md

→https://github.com/VenzoV/MalwareAnalysisReports/blob/main/AmateraStealer/Amatera%20shark.exe.md

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

win.amateraAmatera

External Intelligence

Malpedia: win.amatera

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Amatera