Vidar 2.0

Persistence is then established through a scheduled task named “SystemBackgroundUpdate”, configured to run at user logon with elevated privileges.

Analysis revealed that these executables are PowerShell scripts compiled into .NET binaries using the open-source PS2EXE module.

the script inside the Perfume.mdb file... it becomes clear that the script functions as a dropper for the final payload.

The injected payload extracts encryption keys directly from browser memory, then communicates the stolen keys back to the main malware process via named pipes to avoid disk artifacts.

Persistence is then established through a scheduled task named “SystemBackgroundUpdate”, configured to run at user logon with elevated privileges.

Persistence is then established through a scheduled task named “SystemBackgroundUpdate”, configured to run at user logon with elevated privileges.

The malware also employs an advanced technique that launches browsers with debugging enabled and injects malicious code directly into running browser processes using either shellcode or reflective DLL injection.

The malware also employs an advanced technique that launches browsers with debugging enabled and injects malicious code directly into running browser processes using either shellcode or reflective DLL injection.

The malware also employs an advanced technique that launches browsers with debugging enabled and injects malicious code directly into running browser processes using either shellcode or reflective DLL injection.

Binary analysis reveals that the new version of Vidar employs heavy use of control flow flattening, implementing complex switch-case structures with numeric state machines that can make reverse engineering more difficult.

The downloaded payload (background.exe) is a Themida-packed Vidar stealer 2.0.

The malware also employs an advanced technique that launches browsers with debugging enabled and injects malicious code directly into running browser processes using either shellcode or reflective DLL injection.

The malware also employs an advanced technique that launches browsers with debugging enabled and injects malicious code directly into running browser processes using either shellcode or reflective DLL injection.

The malware also employs an advanced technique that launches browsers with debugging enabled and injects malicious code directly into running browser processes using either shellcode or reflective DLL injection.

It adds a Windows Defender exclusion for a specified attacker-controlled directory... create a randomly named directory inside the %AppData% directory, adds it to Defender’s exclusion list

It is executed as a background process and attempts to elevate its privileges using “runas”.

Extensive anti-analysis checks, including debugger detection, timing checks, uptime, and hardware profiling.

The malware then performs extensive anti-analysis checks including debugger detection, timing verification, system uptime validation, and hardware profiling to ensure execution only occurs on genuine victim systems rather than analysis environments.

it verifies the file by checking the MZ header and sets both the directory and file attributes to “hidden” so that it’s not visible to users.

The malware also employs an advanced technique that launches browsers with debugging enabled and injects malicious code directly into running browser processes using either shellcode or reflective DLL injection.

The malware then performs extensive anti-analysis checks including debugger detection, timing verification, system uptime validation, and hardware profiling to ensure execution only occurs on genuine victim systems rather than analysis environments.

Vidar 2.0 malware has specific logic to enumerate the %USERPROFILE%\.azure directory, using it to extract Azure credentials and exfiltrate the data back to the attackers.

Infostealers scan developer environments for files like credentials.json or .env files that store active OpenAI API keys in plaintext.

Among its traditional credential extraction techniques, the malware employs a tiered approach that includes systematic enumeration of browser profiles and attempting to extract encryption keys from Local State files using standard DPAPI decryption.

Binary analysis reveals that Vidar 2.0 implements comprehensive browser credential extraction capabilities targeting both traditional browser storage methods and Chrome's latest security protections across multiple browser platforms including Chrome, Firefox, Edge, and other Chromium-based browsers.

Following successful evasion, the malware conducts thorough system profiling to collect victim information before launching parallel credential theft operations across multiple categories.

The file grabber component systematically searches for valuable files across user directories and removable drives, focusing on cryptocurrency keys and potential credential files.

MITRE ATT&CK Matrix Tactic Technique ID Technique Name ... T1087.001 Account Discovery: Local Account

Extensive anti-analysis checks, including debugger detection, timing checks, uptime, and hardware profiling.

The malware then performs extensive anti-analysis checks including debugger detection, timing verification, system uptime validation, and hardware profiling to ensure execution only occurs on genuine victim systems rather than analysis environments.

MITRE ATT&CK Matrix Tactic Technique ID Technique Name ... T1518.001 Software Discovery: Security Software Discovery

The malware then performs extensive anti-analysis checks including debugger detection, timing verification, system uptime validation, and hardware profiling to ensure execution only occurs on genuine victim systems rather than analysis environments.

This approach allows the malware to steal data from multiple sources simultaneously - such as browsers, cryptocurrency wallets, and files - rather than processing them one at a time.

The final phases involve screenshot capture for additional intelligence value, followed by comprehensive data packaging and exfiltration through HTTP multipart form submissions

The final phases involve screenshot capture for additional intelligence value, followed by comprehensive data packaging and exfiltration through HTTP multipart form submissions to a round-robin command-and-control (C&C) infrastructure

The final phases involve screenshot capture for additional intelligence value, followed by comprehensive data packaging and exfiltration through HTTP multipart form submissions to a round-robin command-and-control (C&C) infrastructure that includes Telegram bots and Steam profiles as communication channels.

MITRE ATT&CK Matrix Tactic Technique ID Technique Name ... T1573 Encrypted Channel

The malware employs different operation modes to categorize stolen data and uses specific authentication tokens and build identifiers for tracking and victim management.

Vidar 2.0 malware has specific logic to enumerate the %USERPROFILE%\.azure directory, using it to extract Azure credentials and exfiltrate the data back to the attackers.