Do Son 
At a Glance
| Attribute | Details |
|---|---|
| Malware Family | Vidar information stealer |
| Threat Actor | Unknown financially motivated cybercriminals |
| Target Victims | General internet users and corporate networks |
| Delivery Vector | Deceptive software cracks and malicious downloads |
| Key Capabilities | Custom virtual machine execution, stream cipher encryption, credential theft |
| Source | Zscaler ThreatLabz |
Executive Summary
The Vidar information stealer obfuscation process now utilizes a lightweight virtual machine. Specifically, this recent upgrade replaces basic encryption with dynamic stream ciphers. Consequently, defenders face new challenges because these protection layers change with every build.
Delivery Tactics
Attackers distribute this credential stealer through diverse deceptive channels. Campaigns often rely on fake software cracks and malicious game modifications. Unfortunately, unsuspecting users download these files from compromised websites or shady forums. Consequently, the victim executes the payload, thinking it is legitimate software.
Infection Chain and Obfuscation
Once executed, the malware initiates a complex decoding process. The developer shifted away from standard encryption methods starting in internal version 2.0. Now, the malware runs a bytecode interpreter within a custom virtual machine. The system uses a sparse 256-entry dispatch table to process commands. Specifically, fourteen specific handlers carry out the primary decryption tasks. These instructions apply bitwise rotations, addition, and subtraction to reveal hidden data.
Furthermore, the virtual machine handles data differently depending on the version. “For Vidar versions 2.0 and 2.1, the first 9 bytes form the key,” ThreatLabz explained. In newer releases, the initial eight bytes create the decryption key. Meanwhile, the last four bytes consistently generate the cryptographic nonce.
Afterward, a custom stream cipher takes over to reveal the final payload. Versions 2.2 and above utilize an add-rotate-XOR stream cipher. This algorithm mixes the key with a prime constant and a golden ratio value. Ultimately, this process hides readable text like API names and error messages.
The bytecode interpreter operates efficiently without complex memory structures. “The bytecode interpreter consists of a fetch-decode-execute loop with the VM code provided as a byte array,” the report detailed. Additionally, it avoids using traditional stacks or multiple registers. Instead, the matching handler mutates a one-byte accumulator. Then, it emits an output byte when a specific opcode is encountered.
To protect the execution, the malware requires a specific key. “The hardcoded XOR key is a 4-byte value that changes with each build,” researchers stated. This key also serves as a seed for initializing the bytecode interpreter’s accumulator. By changing these elements continuously, developers frustrate reverse engineering efforts.
Prior versions used simpler methods. “Earlier versions of Vidar used single-byte XOR operations to obfuscate strings,” researchers noted. Then, beginning with internal version 1.5, the developer adopted ChaCha20 encryption. Starting in versions 1.8, developers modified the ChaCha20 cipher to make detection and decryption harder. Today, the malware uses a completely different architecture.
Command-and-Control and Data Exfiltration
The primary goal involves stealing valuable user data from infected systems. The malware hunts for saved browser passwords and cryptocurrency wallet keys. It also targets active session cookies and communication application data. Next, the program packages the stolen files for transmission.
The attackers seek rapid monetization of the stolen credentials. Therefore, they focus heavily on cryptocurrency wallet files. The malware specifically extracts session data for Telegram and Discord applications. Meanwhile, it gathers hardware identification details to profile the infected machine. This profiling helps attackers filter high-value targets from standard consumer systems. Furthermore, the malware grabs autocomplete data and autofill forms from web browsers. Consequently, victims face massive risks of identity theft and financial loss.
The malware connects back to remote command-and-control servers. Operators frequently use social media platforms or direct IP addresses to mask traffic. They transmit the compressed archives directly to attacker-controlled infrastructure. By hiding the destination URLs until runtime, the malware evades static security signatures. Thus, network defenders struggle to block these connections because the addresses remain hidden.
Defense and Detection Guidance
Security teams must update their detection strategies to counter these changing tactics. Traditional static signatures fail when the underlying code changes per build. ThreatLabz noted, “These per-build string obfuscation techniques are designed to hinder static and automated analysis.”
Instead, defenders should focus on behavioral detection rules. Monitor for unusual processes accessing browser credential stores. Watch for unexpected network connections originating from standard applications. Organizations should read the Zscaler ThreatLabz report on the Vidar information stealer for specific indicators. Educating employees about the dangers of pirated software remains a critical defense layer. Finally, deploy endpoint detection tools that analyze program behavior during execution.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
