SYMBOLCOMMON_NAMEaka. SYNONYMS
win.vidar (Back to overview)

vidar


Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.

References
2020-03-04CrowdStrikeCrowdStrike
@techreport{crowdstrike:20200304:2020:818c85f, author = {CrowdStrike}, title = {{2020 CrowdStrike Global Threat Report}}, date = {2020-03-04}, institution = {CrowdStrike}, url = {https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf}, language = {English}, urldate = {2020-03-04} } 2020 CrowdStrike Global Threat Report
MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze Necurs Nokki Outlook Backdoor Phobos Ransomware Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot vidar Winnti ANTHROPOID SPIDER Anunak APT39 BlackTech BuhTrap Charming Kitten CLOCKWORD SPIDER DOPPEL SPIDER Gamaredon Group Judgment Panda Leviathan MONTY SPIDER Mustang Panda NARWHAL SPIDER NOCTURNAL SPIDER Pinchy Spider Pirate Panda Salty Spider SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER
2020-02-05CybereasonLior Rochberger, Assaf Dahan
@online{rochberger:20200205:hole:b982e31, author = {Lior Rochberger and Assaf Dahan}, title = {{The Hole in the Bucket: Attackers Abuse Bitbucket to Deliver an Arsenal of Malware}}, date = {2020-02-05}, organization = {Cybereason}, url = {https://www.cybereason.com/blog/the-hole-in-the-bucket-attackers-abuse-bitbucket-to-deliver-an-arsenal-of-malware}, language = {English}, urldate = {2020-02-09} } The Hole in the Bucket: Attackers Abuse Bitbucket to Deliver an Arsenal of Malware
Amadey Azorult Predator The Thief STOP Ransomware vidar
2019-03-11tcontre
@online{tcontre:20190311:infor:d8863ed, author = {tcontre}, title = {{Infor Stealer Vidar TrojanSpy Analysis...}}, date = {2019-03-11}, url = {https://tccontre.blogspot.com/2019/03/infor-stealer-vidar-trojanspy-analysis.html}, language = {English}, urldate = {2020-01-05} } Infor Stealer Vidar TrojanSpy Analysis...
vidar
2019-01-07Bleeping ComputerIonut Ilascu
@online{ilascu:20190107:gandcrab:8167b7f, author = {Ionut Ilascu}, title = {{GandCrab Operators Use Vidar Infostealer as a Forerunner}}, date = {2019-01-07}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/gandcrab-operators-use-vidar-infostealer-as-a-forerunner/}, language = {English}, urldate = {2019-12-20} } GandCrab Operators Use Vidar Infostealer as a Forerunner
Gandcrab vidar
2018-12-24fumik0 blogfumik0
@online{fumik0:20181224:lets:f7dfc2c, author = {fumik0}, title = {{Let’s dig into Vidar – An Arkei Copycat/Forked Stealer (In-depth analysis)}}, date = {2018-12-24}, organization = {fumik0 blog}, url = {https://fumik0.com/2018/12/24/lets-dig-into-vidar-an-arkei-copycat-forked-stealer-in-depth-analysis/}, language = {English}, urldate = {2020-01-13} } Let’s dig into Vidar – An Arkei Copycat/Forked Stealer (In-depth analysis)
vidar
Yara Rules
[TLP:WHITE] win_vidar_auto (20200529 | autogenerated rule brought to you by yara-signator)
rule win_vidar_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-05-30"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.4.0"
        tool_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar"
        malpedia_rule_date = "20200529"
        malpedia_hash = "92c362319514e5a6da26204961446caa3a8b32a8"
        malpedia_version = "20200529"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using yara-signator.
     * The code and documentation / approach is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { c9 c3 8b542408 85d2 7503 }
            // n = 5, score = 1700
            //   c9                   | leave               
            //   c3                   | ret                 
            //   8b542408             | mov                 edx, dword ptr [esp + 8]
            //   85d2                 | test                edx, edx
            //   7503                 | jne                 5

        $sequence_1 = { 8b4120 8910 8b4130 8910 c3 56 }
            // n = 6, score = 1700
            //   8b4120               | mov                 eax, dword ptr [ecx + 0x20]
            //   8910                 | mov                 dword ptr [eax], edx
            //   8b4130               | mov                 eax, dword ptr [ecx + 0x30]
            //   8910                 | mov                 dword ptr [eax], edx
            //   c3                   | ret                 
            //   56                   | push                esi

        $sequence_2 = { c20400 ff742408 e8???????? 59 83f8ff 7503 }
            // n = 6, score = 1700
            //   c20400               | ret                 4
            //   ff742408             | push                dword ptr [esp + 8]
            //   e8????????           |                     
            //   59                   | pop                 ecx
            //   83f8ff               | cmp                 eax, -1
            //   7503                 | jne                 5

        $sequence_3 = { 8b4508 8906 8b450c 894608 8b4510 }
            // n = 5, score = 1700
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8906                 | mov                 dword ptr [esi], eax
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   894608               | mov                 dword ptr [esi + 8], eax
            //   8b4510               | mov                 eax, dword ptr [ebp + 0x10]

        $sequence_4 = { c20400 56 8bf1 8b4e20 33c0 }
            // n = 5, score = 1700
            //   c20400               | ret                 4
            //   56                   | push                esi
            //   8bf1                 | mov                 esi, ecx
            //   8b4e20               | mov                 ecx, dword ptr [esi + 0x20]
            //   33c0                 | xor                 eax, eax

        $sequence_5 = { c20800 56 57 8b7c240c 8b07 8bf1 8bcf }
            // n = 7, score = 1700
            //   c20800               | ret                 8
            //   56                   | push                esi
            //   57                   | push                edi
            //   8b7c240c             | mov                 edi, dword ptr [esp + 0xc]
            //   8b07                 | mov                 eax, dword ptr [edi]
            //   8bf1                 | mov                 esi, ecx
            //   8bcf                 | mov                 ecx, edi

        $sequence_6 = { e8???????? 0fb6c0 50 ff742410 56 e8???????? }
            // n = 6, score = 1700
            //   e8????????           |                     
            //   0fb6c0               | movzx               eax, al
            //   50                   | push                eax
            //   ff742410             | push                dword ptr [esp + 0x10]
            //   56                   | push                esi
            //   e8????????           |                     

        $sequence_7 = { 56 8b742408 8b06 8b4804 6a0a 03ce e8???????? }
            // n = 7, score = 1700
            //   56                   | push                esi
            //   8b742408             | mov                 esi, dword ptr [esp + 8]
            //   8b06                 | mov                 eax, dword ptr [esi]
            //   8b4804               | mov                 ecx, dword ptr [eax + 4]
            //   6a0a                 | push                0xa
            //   03ce                 | add                 ecx, esi
            //   e8????????           |                     

        $sequence_8 = { c3 8bff 55 8bec 83ec0c c745fc00000000 }
            // n = 6, score = 200
            //   c3                   | ret                 
            //   8bff                 | mov                 edi, edi
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   83ec0c               | sub                 esp, 0xc
            //   c745fc00000000       | mov                 dword ptr [ebp - 4], 0

        $sequence_9 = { e8???????? ff35???????? a3???????? ff15???????? }
            // n = 4, score = 200
            //   e8????????           |                     
            //   ff35????????         |                     
            //   a3????????           |                     
            //   ff15????????         |                     

        $sequence_10 = { 83ec08 dd4508 dd1c24 6a0b 6a10 }
            // n = 5, score = 200
            //   83ec08               | sub                 esp, 8
            //   dd4508               | fld                 qword ptr [ebp + 8]
            //   dd1c24               | fstp                qword ptr [esp]
            //   6a0b                 | push                0xb
            //   6a10                 | push                0x10

        $sequence_11 = { 6a0b 6a10 e8???????? 83c41c 8be5 }
            // n = 5, score = 200
            //   6a0b                 | push                0xb
            //   6a10                 | push                0x10
            //   e8????????           |                     
            //   83c41c               | add                 esp, 0x1c
            //   8be5                 | mov                 esp, ebp

        $sequence_12 = { 83e03f 6bc038 8b149518154900 884c0228 eb1c }
            // n = 5, score = 100
            //   83e03f               | and                 eax, 0x3f
            //   6bc038               | imul                eax, eax, 0x38
            //   8b149518154900       | mov                 edx, dword ptr [edx*4 + 0x491518]
            //   884c0228             | mov                 byte ptr [edx + eax + 0x28], cl
            //   eb1c                 | jmp                 0x1e

        $sequence_13 = { ff9508bfffff 83c410 8945f4 8b55b8 0355f4 c60200 8b45e0 }
            // n = 7, score = 100
            //   ff9508bfffff         | call                dword ptr [ebp - 0x40f8]
            //   83c410               | add                 esp, 0x10
            //   8945f4               | mov                 dword ptr [ebp - 0xc], eax
            //   8b55b8               | mov                 edx, dword ptr [ebp - 0x48]
            //   0355f4               | add                 edx, dword ptr [ebp - 0xc]
            //   c60200               | mov                 byte ptr [edx], 0
            //   8b45e0               | mov                 eax, dword ptr [ebp - 0x20]

        $sequence_14 = { 50 e8???????? 8d44244c 50 8b442454 8d4c2474 }
            // n = 6, score = 100
            //   50                   | push                eax
            //   e8????????           |                     
            //   8d44244c             | lea                 eax, [esp + 0x4c]
            //   50                   | push                eax
            //   8b442454             | mov                 eax, dword ptr [esp + 0x54]
            //   8d4c2474             | lea                 ecx, [esp + 0x74]

    condition:
        7 of them and filesize < 2793472
}
[TLP:WHITE] win_vidar_w0   (20190106 | Yara rule for detecting Vidar stealer)
rule win_vidar_w0 {
    meta:
        description = "Yara rule for detecting Vidar stealer"
        author = "Fumik0_"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar"
        malpedia_version = "20190106"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $s1 = { 56 69 64 61 72 }
        $s2 = { 31 42 45 46 30 41 35 37 42 45 31 31 30 46 44 34 36 37 41 }
        
    condition:
        all of them
}
Download all Yara Rules