Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation

MITRE Techniques

• [T1574.002 ] DLL Side-Loading – Fake MpClient.dll variants exported Defender-like functions so a legitimate binary would load the malicious DLL first (‘malicious copy first if it is placed in a higher-priority search path’).
• [T1036 ] Masquerading – The malware used filenames and signatures that mimicked legitimate software and vendors, including MicrosoftUpdate.exe, MicrosoftEdgeUpdate.exe, NisSrv.exe, and fake JustWatch/BleacherReport certificates (‘mimic cracked versions’, ‘blend in with legitimate Windows Defender components’).
• [T1562.001 ] Disable or Modify Tools – The payload patched AmsiScanBuffer to force E_INVALIDARG and reduce detection by security tools (‘overwrites its first six bytes with a patch’, ‘might disable Windows AMSI’).
• [T1055 ] Process Injection – Not directly described as classic injection into another process, but the in-memory patching of AMSI within loaded amsi.dll altered security behavior inside the process context (‘loads amsi.dll, resolves the AmsiScanBuffer variable’).
• [T1112 ] Modify Registry – Persistence was established with an HKCU Run key pointing to NisSrv.exe (‘HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun’).
• [T1053.005 ] Scheduled Task/Job: Scheduled Task – The malware created an on-logon scheduled task for persistence (‘schtasks /create … /sc onlogon’).
• [T1547.001 ] Registry Run Keys / Startup Folder – Persistence also used a Startup folder batch script (‘C:ProgramDataMicrosoftWindowsStart MenuProgramsStartUpFEbJCNWOCKMJ.bat’).
• [T1082 ] System Information Discovery – The malware collected hardware IDs, volume serial-related identifiers, and geolocation information (‘gathers information about files, hardware IDs (HWID)’; ‘GET request to ip-api[.]com/json’).
• [T1049 ] System Network Connections Discovery – The campaign enumerated processes and bypassed proxies as part of environment awareness (‘anti-analysis techniques such as process enumeration’).
• [T1027 ] Obfuscated Files or Information – Strings, blobs, and data were XOR-obfuscated to evade static analysis (‘XOR-obfuscated with single-byte key 0x05′, ’32-byte rotating XOR’).
• [T1105 ] Ingress Tool Transfer – The initial loader delivered and dropped additional payloads including Vidar and XMRig after execution (‘drops and runs both Vidar stealer and XMRig’).
• [T1071.001 ] Application Layer Protocol: Web Protocols – The malware used HTTP requests for geolocation and network communication to remote servers (‘GET request to ip-api[.]com/json’, ‘communicating with a command-and-control (C2) server’).
• [T1041 ] Exfiltration Over C2 Channel – Vidar packaged stolen data into a ZIP and exfiltrated it to the C2 server (‘packaging everything into a ZIP for exfiltration to 136.243.203[.]109:443’).
• [T1496 ] Resource Hijacking – XMRig mined Monero using victim CPU resources (‘XMRig mines Monero cryptocurrency’, ‘passive income from hijacked victim CPU cycles’).
• [T1090 ] Proxy – The malware bypassed proxies during reconnaissance (‘bypasses proxies’).