A newly discovered malware loader uses lists of ordinary English words to conceal and reconstruct malicious code, helping a rapidly growing infostealer evade detection before infecting victims.
Researchers from Gen Threat Labs recently discovered WordlistLoader, a loader used to infect victims with the Amatera infostealer. As a loader, it exists between the initial infection and the final payload. Loaders can be used for a variety of purposes, such as getting deeper into a victim's machine, evading defenses, downloading and decrypting later stage malware, or launching other necessary programs.
WordlistLoader's job is to prepare the environment, evade security controls, reconstruct the next-stage payload, and then hand execution off to the infostealer. "Amatera has been actively developed over the past few months and has gradually become one of the most prevalent infostealers in our user base," Gen Threat researcher Vojtěch Krejsa wrote in the report.
Amatera Stealer (as it's usually referred to) has been in the wild for a little over a year and has become a popular malware-as-a-service strain. Proofpoint researchers said last June that the stealer is based on the ACR Stealer and is capable of sweeping up data for software wallets, cryptocurrency wallets, credentials, browser data, and message history.
Like the campaign Proofpoint disclosed a year ago, WordlistLoader is distributed via ClearFake campaigns seemingly targeting Windows machines. ClearFake is a threat cluster that delivers infections primarily via ClickFix-style attacks.
How WordlistLoader Uses Plain English to Rebuild Malware
WordlistLoader includes four key functions, according to the Gen report. The primary one is that it "reconstructs shellcode that serves as the entry point for subsequent stages." WordlistLoader includes a series of plain English words that looks innocuous but can be translated back into executable code prior to running it. Its primary job is to reconstruct hidden malicious code that serves as the entry point for later stages of the infection chain.
"The mapping from English words to byte values is defined by a build-specific wordlist of 256 distinct words: the word at index 0 decodes to 0x00, the word at index 144 to 0x90, and so on," Krejsa wrote. "Both the wordlist and the encoded sequence are stored as arrays of pointers, so the loader matches addresses rather than the strings themselves. Rebuilding the shellcode thus comes down to iterating over the word sequence, looking up each word in the list, and writing the index of the matching entry into the output buffer."