Peeling Back the Layers: Inside Vidar - From Virtualized Code to Stolen Credentials
Source AlienVault OTX General
Description
This analysis examines a sophisticated Vidar infostealer variant that employs a custom virtual machine to obfuscate its malicious code through proprietary bytecode interpretation. The malware implements extensive anti-analysis measures including debugger detection via NtQueryInformationProcess and RDTSC timing checks, sandbox evasion by identifying antivirus processes and checking system resources, and environment fingerprinting. Vidar targets credentials from web browsers including Chromium and Gecko-based extensions, Azure authentication tokens, FileZilla FTP credentials, and captures screenshots. It utilizes SeDebugPrivilege for elevated access, creates hidden desktops for browser automation, and exfiltrates stolen data through Telegram channels. The malware performs cleanup operations to remove execution artifacts and proxies DLL execution through rundll32.exe to blend with legitimate Windows processes.
Impact
Vidar compromises user credentials from multiple sources including web browsers and FTP clients, as well as Azure authentication tokens, potentially allowing attackers unauthorized access to user accounts and cloud resources. The malware's use of elevated privileges and stealth techniques increases the difficulty of detection and removal. Data exfiltration via Telegram channels enables attackers to receive stolen information covertly. The overall impact includes credential theft, potential account takeover, and privacy breaches.
Defensive guidance
No official patch or remediation is available as this is malware rather than a software vulnerability. Mitigation focuses on detection and prevention through endpoint protection solutions capable of identifying Vidar's behavior and indicators, including its anti-analysis techniques and use of rundll32.exe for DLL proxying. Monitoring for suspicious use of SeDebugPrivilege and hidden desktop creation may aid detection. Network monitoring for unusual Telegram traffic could help identify data exfiltration attempts. Users should maintain updated antivirus and endpoint detection and response (EDR) tools and exercise caution with email attachments and downloads to prevent infection.