Vidar distributed through backdoored Windows 11 downloads and abusing Telegram

MITRE Techniques

• [T1036] Masquerading – The threat actor registered domains that masquerade as the official Windows 11 download page. ‘The threat actor registered several domains beginning 20th April 2022 that host web pages that masquerade as the official Microsoft Windows 11 download page’
• [T1566] Phishing – Social engineering to impersonate popular legitimate software applications to distribute Vidar malware. ‘ThreatLabz believes that the same threat actor is actively leveraging social engineering to impersonate popular legitimate software applications to distribute Vidar malware, as we have also identified an attacker-controlled GitHub repository which hosts several backdoored versions of Adobe Photoshop.’
• [T1071] Application Layer Protocols – C2 addresses fetched from attacker-controlled social media accounts on Telegram and Mastodon. ‘All the binaries involved in this campaign fetch the IP addresses of the C2 servers from attacker-registered social media accounts on the Telegram and Mastodon networks.’
• [T1105] Ingress Tool Transfer – Libraries are downloaded from the C2, including update.zip containing DLLs. ‘The following libraries are downloaded from the C2:’
• [T1116] Code Signing – The binary is signed with an Avast certificate (expired). ‘The binary inside the ISO file is digitally signed with a certificate by AVAST. However, this certificate is expired and hence invalid.’
• [T1027] Obfuscated/Compressed Files and Information – Vidar samples are packed with Themida and inflated in size with padding. ‘The Vidar samples in these campaigns are all packed with Themida … and over 330MB in size. However, the sample contains a PE file that is only around 3.3MB. Figure 3 shows that the rest of the file content is just artificially filled up with 0x10 bytes to increase the file’s size.’