Threat video1:00
Vidar Stealer Per-Build VM Obfuscation: Detection & IOCs
Vidar rebuilds its bytecode VM and stream cipher per build to hide strings, so analysts need 9 detection rules, 10 IOCs and a free Splunk SPL rule.
Read the full threat intel for Vidar Stealer Per-Build VM Obfuscation: Detection & IOCs →
Chapters
- 0:00The hookVidar obfuscates strings in a VM.
- 0:04The storyZscaler first saw a custom VM.
- 0:10Attack pathAcronis reported fake game cheats.
- 0:25AttributionNo threat actor is attributed.
- 0:30Indicators of compromise5 indicators to hunt: 4 SHA-256 hashes and 1 file name.
- 0:37MITRE ATT&CK techniques14 ATT&CK techniques, from execution to command and control.
- 0:42Remediation4 steps now: Hunt for the listed SHA-256 hashes across EDR and file.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Vidar obfuscates strings in a VM.
0:05Zscaler first saw a custom VM.
0:07Each build varies its ciphers.
0:11Acronis reported fake game cheats.
0:13The VM decodes some strings directly.
0:16C2 resolves via Mastodon, Telegram or Steam.
0:20Browser injection aims to bypass AppBound encryption.
0:26No threat actor is attributed. Confidence: low.
0:305 indicators to hunt: 4 SHA-256 hashes and 1 file name.
0:3814 ATT&CK techniques, from execution to command and control.
0:434 steps now: Hunt for the listed SHA-256 hashes across EDR and file.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.