MALWARE FAMILY

Amatera

Internal ID: win.amatera

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Amatera is a stealer written in C++. It conducts anti-sandbox analysis before enumerating browsers, exfiltrating found cryptocurrency files/wallets and possibly credentials.

Threat Analysis

Amatera is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://bazaar.abuse.ch/sample/73fd51d4a0959e5c5a82db9be0d765069d02a2b97f51f55f5d6422a7bec01caa/

→https://blackpointcyber.com/blog/novel-fake-captcha-chain-delivering-amatera-stealer/

→https://cip.gov.ua/services/cm/api/attachment/download?id=71278

→https://github.com/VenzoV/MalwareAnalysisReports/blob/main/AmateraStealer/Amatera%20Stealer%20v1.md

→https://github.com/VenzoV/MalwareAnalysisReports/blob/main/AmateraStealer/Amatera%20shark.exe.md

→https://www.proofpoint.com/us/blog/threat-insight/amatera-stealer-rebranded-acr-stealer-improved-evasion-sophistication

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.amatera

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Amatera