Amatera - Run Key Persistence From User-Writable Path

Georg Lauenstein@gsec

•updated yesterday•0•0•1

Detects a Run/RunOnce registry value whose data points to an executable or script in a user-writable location (AppData, Temp, ProgramData, Users\\Public). Amatera establishes persistence by adding Run key entries that relaunch the stealer on user logon.