Threats Tagged 'azure tokens'

This analysis covers a sophisticated variant of the Vidar infostealer malware that uses a custom virtual machine to obfuscate its code. It employs multiple anti-analysis techniques such as debugger detection, timing checks, sandbox evasion, and environment fingerprinting. Vidar targets credentials from Chromium and Gecko-based browsers, Azure authentication tokens, and FileZilla FTP credentials, while also capturing screenshots. It uses elevated privileges and hidden desktops for browser automation and exfiltrates stolen data via Telegram channels. The malware cleans up execution artifacts and uses DLL proxying through rundll32.exe to evade detection.