Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation

Domains/URLs

justwatch.com

IP Address

116.203.243.208

136.243.203.109

136.243.203.111

138.199.246.13

Hash

d42595b695fc008ef2c56aabd8efd68e

d8b31f8c03e0c76ff245ed05a15ffe6c

1aae8bf580c846f39c71c05898e57e88

c10333c92889b65c3590ef2b3819b420

ab92f731ab20774dfdb95664ee41a2fbafe2a284

097a87cfa4a5186aba3bba096866692951bde59c6f0c2e8c1c4a599246d14da8

201594c9d173bba6cb509407ecba378c19b93da0a81a2182a913c480e6dbb54e

20bf39e1e67152039e70a01ad9e7b23c08d23d2a724ef9c44903f3d4353a2275

35dde1b2482b12582820a861e7c46f10721af6b75052fc872c05d2230a4e8ca1

43920ef7d2742d140a1ab2a1ef172c716903474c73561377dc4f1534d2c5f581

47d6d1a38534ba897a5a1e293e3d5df303bbd8e0526e756ad08887ffc1417bef

68ced9d7c1b1ff8ffb5f56c7d3f849d4fd16a1b95324426811424b40043d6d25

6b7ff061eebeb9ead8812c410247768a7ba90786aeeb1bafa6412cc5b08237b5

739cdedb20de39aeb1f15dc8c2dbbf15fa993250fd879bf87443ff9aeaf4997b

74df77b6a83d89fa137fd285a2efde36b1d62c00b3be81cc93df7d1e6e94837b

8b40cc7d173efd27fb60f3d260acef28f58d67d1f39597e1d611db311a305f62

9656d3301f63ef6114289739a1c44082206298f787238fc6c190ad87eab24751

9b3df1b6c1b98c201de09a7719066f7bcae6b66a3173b703a617f53fddf67d51

a17a972a05afe387ed32aa2986d5be8bca2f22619d0aedfa834c6963abfab3bf

a4f979b4a5d7bc8bc455dd4c09b44e51a389576fccce35a2c8da3ce680237565

a64843ebfbc39e96ec7613003b1b5c3a9b878874ea15a05e1d34ce91781ebfb6

aaa2bc1128d8b8b2da76262bf87ede19bac053cca6576efba6aaa71c9438c304

b830f043076a12748b6a2dc0810ece85439ee77434d991ae7d84201b09ead756

bb30cc2b302d9a6963109b201b78d4163bb6c2d7bc8bf5a66e9a744b62fc2717

c328b78c21060e2203ac517833fce41572b91878e187f85fa434cd6914659834

c7a4a547eb7f6b0b4b75bb6dd8955244bb2618ba234ae740cdedd7c2d30e3465

d384c403c084967d8c967501ee6332b050af04ef424f13a3f5a88d155389d98c

d6446f2803444bd2200d48a01a9ad7d487e67e8e831c9cd13f89cbfec17fd4e2

d7c9c9469c513c05aa431fae34f414f91fcf3f794d3e76b6e4d0b92c4cd3ff2e

d8c1f96107a3349e62b3ab9afc60f62af9c89b6961b637a26b71e1230f2b3b8a

f0dcb7e407de85d8de8e2221df8dddecac8aec88af8975c9f07e14100f6edb88

0a6a67a2fc4d79ec1cd8afc5b8b7a5e69a406e53d57a7334e097c5d0644de5f6

488d941b7b4428b0f4a0e5495e3857b9b96215fb3e7f164b06640d59096425e6

5d7324d8b5a25f862ef8223c6766d0e80af3ad168e17312b265e13a3a68e0ded

7720e83c02a027d70ae201c393c1956aa2fa8199879a3a4c4fd1d20b03022cfd

7e49da0ae2f81e14841f356b4d69f0480c2d9ce3fab5a3fa91b0036d9a36fa0f

b8b5f6991a3a61083461d5269245bebf28b90934c328848ba8c1e084a5a6216c

b927d265fa29e471c1ae0d31516e480c09c0fb17f480ad08ea8d5b73e84b7a1b

b9b6893fa6b04ee8daa29e515c08239ac5204af1a1fa2bc10006eede1b41329b

c7c37a973b14edd5b6b2da4a1497c593e43640735ff54aecc9a3288fa5e548e3

d2148a458da46e81702136aa915312d360805f083d1f37ff5531db9fbdb8ad6d

d7b56818c829960b692de9ad5a14e52669d953e9f074f7218c3fe34ede4a11a0

db2a872f712fbdb1e347d06e29a9ed8278d86710ffc14ff04422be76e47124f4

e9e5e748ec5c0b811c8e60b0e55059edb4d2df86ff3ca45969e57d5fecb11a38

03e6f4f49cec3af38bbec9ed64c195c7a85a630ec989efb3669f04a2993c1dd7

914c18a04a2727bba9cecab78a1d516ec3c7a3f667e0e5a6081aa0e9206a69fe

d78082dc33c6dca98316e865efa9829c6eb5a97c2ca3cd4ea6c2123a5f6ae45b

7ed4a256e1d281cb4f194d13ff554fd4fb280dafde0a67a18115ea038ea6c87d

15489bcd6e4602b41c9a787ec8d7ab027d5e45d400938048bb1c702ad5937980

169a330353e53a409e0109c914404354741ff1e1c64e501738dc05e58ea92abc

2a02ec4af5ed591afdf1236a443e3b68642ee133f38a2857d1eada51246ab498

2b7297a5f502a2e9a59066f0a370bc5a8b28addd0e27975db3d770f801c15397

2c0b344af415b787b396c8e23bbeb112bd471a1ca1d12cf357c48e2ee1ae068c

2c6e8f86c05781af12b323311e83e011f1a603928e2086c48e2ca59e33d90dbe

2e11a16f94484e0f43eb4572f800f26f0b4a1314cbdae3c44c1ae35f376906d8

2f1400a91c853d61622f4d21ed97d96ea1093c0fa1586669bea6f6baa331251f

314ce675c040c63b825f213965f5c76a3bd09bf70e138708367e2a84e9e84b30

32172e4d8d2ab9fb29b36c9b279117be6ff611b5b91ff7b1c42501a5ec969f2b

330efeebba3782994612fdfe20ff96c930af33a83b88a342b6622461511921b2

35b51bbe42edd15918b015eaa1b4f0e6b5c94f186d71d887e39f1da69a4dec3f

3c3f12531045b7eedfe25e0f291d4792b0d8c8366f8de043e2fa8ecf34ccb913

3db33b0423bb9278db267a7adb036ecbd6aeebd7909d06d824919708b1e12e1b

3e906ae47e9836a591f44d4b743e961d634a404fa8fd8bfae64f1d54c853be2b

4bf770a59d367b532dec32668f86003b17d93918dba5ef5fd2b19c5394252436

4f456142caf590d98fb11ca247800bb417766714527e5a4707ac2f5d01542626

53d263b292be387843fadb7131c2d538b4262c81f5b95cfacafacf2d5446c06e

5494909e0f5221db75e933b28981b2d0e118f227b7d8a5980d88b500b76dfc2e

54dc05ab56244444f86d69b8274a6075906f7ba2307b08e08d3884abde255495

559f46ceb801a3540eace594476718e1486b5b4423cfb4ff64530ff8fb4a3815

5838ae6c748dcbdfa13c6529c654cb821897d29835d3e7e05ca23fb2f3794f02

59b9153c4c9e155c976db1a2fd4d1b28fa10bb9c4dcafdc4758b352c037e3d86

5b6a466b65d479b77a03b15a95ac097b45e23ff7ae5ef6282985b2a503deb691

613e5314a7ded3155cdec49fd34e852e181f4651d78bd8bf3adad2f4dbf22b0d

62877a5096828c4bc2fca7cbee7d38b11a0c90fd0d3fc8c37981581e9988c919

634e89d8592d7c9e2bc1c098217a813947b44a4f80bc569e9a15c1e8b0864b91

67569adec99fd38b114ae07e2e549e6c16f75368f3c5373022c84934ed1c8e84

6d49233b1fca22f3823e856e4c16749e9c45f384ea57055fead16df35b217226

71c79e8bf71ed257435ea9b8b91e118ba03ec681860651190f7d7457804313ee

77469615c5f548063922b469a8c0a4116511395d013e5a798e123e9c119acc4b

7828e17e674507ab13dfd84b31b361fa19b9cb27ee130620ba9211feef746d31

8dbcde2a28a0b3de201214d7e3bd43acc97561924daa247c05c4b0536d42be85

901a43b42f997710147295a0625e20c935207f8c531daf5311449ec119a37dcc

94db6fa14b4e487dffba709b87e8a7e25483300ed409de243b19fff7cf2f0978

95cd48130247525d8a7e966bd3fa07e9d6c39ebbe3058ecccb336f66bb8e3d1e

96bb418128deeb2b9d2e4b66b98cae07b238b326b6456cc9b86802e67c504a03

98cce1e69873de25e5139aa848f469bef2af345a8a49d15000b5b5e72b582896

a1039de7ec690d64db9d7d91f3d777d308e49e958de4154aa0b62ded7820f1fe

a785fc61fc4ff7cff0ddb540bf7ff12111ed0d6031f78f48387a6c16cb3c5451

aa0083f662f055e8d911c5de3a8f3a31b3c84cacc7dccc30c98f2be14dba4102

b58814fb3ce5a085014ee6e8d89f7cc1380b234b97170fd5f3398031281c6a77

b6912c23cccc4b0964d55608916297f6978f0b38c80a4beac472004a786fcef7

bd3230e4ceaf32ad2248ab069b164bd2144401967ac69de0a4cd1734fe429d9c

c25799facb3e788830bcf614f33411d3bcfc0edd4a2200e160b5eb4ce700039f

c39fedb662259bd76b11616966c41ff1fbda58d9b129b9c1bd818700eea92b29

ca8a00c9d36c64e5dcf562c7ae2b8df4bd6455fe0b41b32ee3a2a528ddc2d155

ce379de03e35e0ea2c88744c29b9e2678165214065f9b957177002c6bbe69084

d18369be4487d7cd0e4bd3dd0da720672e56e13ca43627305e26767e26925551

d7745513034af14617436ad6b3fc125fd0343218411d0c79bda56b0dadc86b2b

d8ac0c08e4c698017558e532974cf749135d3d49757f05001e6127dc6e07cf17

dccf9f008b42a04f7e69d3bbf7b5ce81e71308545d6176cc4763920a424e5ac1

e5341edb7c039c456d46c39f194be86ce4b41725d7ad12d297d18aa99cddd675

e88c41a6f769cd760e323b4f7c01835433cd4059cd59630cb1a9eb1181b350ed

f13f9cef5cc020bf673c7f4e19c93c312a043867f46796a8f01927a9a14c2533

f760bc16a585325ba9d74917f9e0994d3a4164c1141158c799b619d2c823e818

File Paths

%TEMP%\MicrosoftUpdate.exe

%AppData%\Roaming\Microsoft\Windows\Temp\MicrosoftEdgeUpdate.exe

%AppData%\Roaming\Microsoft\Windows\Temp\NisSrv.exe

%AppData%\Roaming\Microsoft\Windows\Temp\libuv-1.dll

%AppData%\Roaming\Microsoft\Windows\Temp\WinRing0x64.sys

%AppData%\Roaming\Microsoft\Windows\Temp\mgwthmc2.dat

%StartUp%\FEbJCNWOCKMJ.bat

Registry Key

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 

Processname

\AppData\Roaming\Microsoft\Windows\Temp\NisSrv.exe

\schtasks.exe

Scheduled Task

SystemAgentService

Commandline

/create

/sc

onlogon

SystemAgentService

NisSrv.exe -s

Detection Query 1 :

domainname like "justwatch.com" or url like "justwatch.com" or siteurl like "justwatch.com"

Detection Query 2 :

dstipaddress IN ("136.243.203.111","116.203.243.208","138.199.246.13","136.243.203.109") or srcipaddress IN ("136.243.203.111","116.203.243.208","138.199.246.13","136.243.203.109")

Detection Query 3 :

md5hash IN ("d42595b695fc008ef2c56aabd8efd68e","d8b31f8c03e0c76ff245ed05a15ffe6c","1aae8bf580c846f39c71c05898e57e88","c10333c92889b65c3590ef2b3819b420")

Detection Query 4 :

sha1hash IN ("ab92f731ab20774dfdb95664ee41a2fbafe2a284")

Detection Query 5 :

sha256hash IN ("c328b78c21060e2203ac517833fce41572b91878e187f85fa434cd6914659834","3db33b0423bb9278db267a7adb036ecbd6aeebd7909d06d824919708b1e12e1b","a1039de7ec690d64db9d7d91f3d777d308e49e958de4154aa0b62ded7820f1fe","62877a5096828c4bc2fca7cbee7d38b11a0c90fd0d3fc8c37981581e9988c919","d78082dc33c6dca98316e865efa9829c6eb5a97c2ca3cd4ea6c2123a5f6ae45b","47d6d1a38534ba897a5a1e293e3d5df303bbd8e0526e756ad08887ffc1417bef","77469615c5f548063922b469a8c0a4116511395d013e5a798e123e9c119acc4b","71c79e8bf71ed257435ea9b8b91e118ba03ec681860651190f7d7457804313ee","dccf9f008b42a04f7e69d3bbf7b5ce81e71308545d6176cc4763920a424e5ac1","59b9153c4c9e155c976db1a2fd4d1b28fa10bb9c4dcafdc4758b352c037e3d86","94db6fa14b4e487dffba709b87e8a7e25483300ed409de243b19fff7cf2f0978","35b51bbe42edd15918b015eaa1b4f0e6b5c94f186d71d887e39f1da69a4dec3f","b927d265fa29e471c1ae0d31516e480c09c0fb17f480ad08ea8d5b73e84b7a1b","201594c9d173bba6cb509407ecba378c19b93da0a81a2182a913c480e6dbb54e","7720e83c02a027d70ae201c393c1956aa2fa8199879a3a4c4fd1d20b03022cfd","f13f9cef5cc020bf673c7f4e19c93c312a043867f46796a8f01927a9a14c2533","b9b6893fa6b04ee8daa29e515c08239ac5204af1a1fa2bc10006eede1b41329b","c39fedb662259bd76b11616966c41ff1fbda58d9b129b9c1bd818700eea92b29","3e906ae47e9836a591f44d4b743e961d634a404fa8fd8bfae64f1d54c853be2b","b8b5f6991a3a61083461d5269245bebf28b90934c328848ba8c1e084a5a6216c","f760bc16a585325ba9d74917f9e0994d3a4164c1141158c799b619d2c823e818","d8ac0c08e4c698017558e532974cf749135d3d49757f05001e6127dc6e07cf17","2a02ec4af5ed591afdf1236a443e3b68642ee133f38a2857d1eada51246ab498","4bf770a59d367b532dec32668f86003b17d93918dba5ef5fd2b19c5394252436","43920ef7d2742d140a1ab2a1ef172c716903474c73561377dc4f1534d2c5f581","68ced9d7c1b1ff8ffb5f56c7d3f849d4fd16a1b95324426811424b40043d6d25","c25799facb3e788830bcf614f33411d3bcfc0edd4a2200e160b5eb4ce700039f","d6446f2803444bd2200d48a01a9ad7d487e67e8e831c9cd13f89cbfec17fd4e2","097a87cfa4a5186aba3bba096866692951bde59c6f0c2e8c1c4a599246d14da8","8b40cc7d173efd27fb60f3d260acef28f58d67d1f39597e1d611db311a305f62","2e11a16f94484e0f43eb4572f800f26f0b4a1314cbdae3c44c1ae35f376906d8","db2a872f712fbdb1e347d06e29a9ed8278d86710ffc14ff04422be76e47124f4","bd3230e4ceaf32ad2248ab069b164bd2144401967ac69de0a4cd1734fe429d9c","3c3f12531045b7eedfe25e0f291d4792b0d8c8366f8de043e2fa8ecf34ccb913","d8c1f96107a3349e62b3ab9afc60f62af9c89b6961b637a26b71e1230f2b3b8a","8dbcde2a28a0b3de201214d7e3bd43acc97561924daa247c05c4b0536d42be85","9b3df1b6c1b98c201de09a7719066f7bcae6b66a3173b703a617f53fddf67d51","2c6e8f86c05781af12b323311e83e011f1a603928e2086c48e2ca59e33d90dbe","d18369be4487d7cd0e4bd3dd0da720672e56e13ca43627305e26767e26925551","aaa2bc1128d8b8b2da76262bf87ede19bac053cca6576efba6aaa71c9438c304","32172e4d8d2ab9fb29b36c9b279117be6ff611b5b91ff7b1c42501a5ec969f2b","35dde1b2482b12582820a861e7c46f10721af6b75052fc872c05d2230a4e8ca1","c7c37a973b14edd5b6b2da4a1497c593e43640735ff54aecc9a3288fa5e548e3","ce379de03e35e0ea2c88744c29b9e2678165214065f9b957177002c6bbe69084","e5341edb7c039c456d46c39f194be86ce4b41725d7ad12d297d18aa99cddd675","7ed4a256e1d281cb4f194d13ff554fd4fb280dafde0a67a18115ea038ea6c87d","a64843ebfbc39e96ec7613003b1b5c3a9b878874ea15a05e1d34ce91781ebfb6","634e89d8592d7c9e2bc1c098217a813947b44a4f80bc569e9a15c1e8b0864b91","54dc05ab56244444f86d69b8274a6075906f7ba2307b08e08d3884abde255495","d2148a458da46e81702136aa915312d360805f083d1f37ff5531db9fbdb8ad6d")

Detection Query 6 :

sha256hash IN ("2f1400a91c853d61622f4d21ed97d96ea1093c0fa1586669bea6f6baa331251f","67569adec99fd38b114ae07e2e549e6c16f75368f3c5373022c84934ed1c8e84","96bb418128deeb2b9d2e4b66b98cae07b238b326b6456cc9b86802e67c504a03","98cce1e69873de25e5139aa848f469bef2af345a8a49d15000b5b5e72b582896","5d7324d8b5a25f862ef8223c6766d0e80af3ad168e17312b265e13a3a68e0ded","20bf39e1e67152039e70a01ad9e7b23c08d23d2a724ef9c44903f3d4353a2275","7e49da0ae2f81e14841f356b4d69f0480c2d9ce3fab5a3fa91b0036d9a36fa0f","314ce675c040c63b825f213965f5c76a3bd09bf70e138708367e2a84e9e84b30","b58814fb3ce5a085014ee6e8d89f7cc1380b234b97170fd5f3398031281c6a77","169a330353e53a409e0109c914404354741ff1e1c64e501738dc05e58ea92abc","5b6a466b65d479b77a03b15a95ac097b45e23ff7ae5ef6282985b2a503deb691","e9e5e748ec5c0b811c8e60b0e55059edb4d2df86ff3ca45969e57d5fecb11a38","4f456142caf590d98fb11ca247800bb417766714527e5a4707ac2f5d01542626","f0dcb7e407de85d8de8e2221df8dddecac8aec88af8975c9f07e14100f6edb88","2c0b344af415b787b396c8e23bbeb112bd471a1ca1d12cf357c48e2ee1ae068c","0a6a67a2fc4d79ec1cd8afc5b8b7a5e69a406e53d57a7334e097c5d0644de5f6","53d263b292be387843fadb7131c2d538b4262c81f5b95cfacafacf2d5446c06e","901a43b42f997710147295a0625e20c935207f8c531daf5311449ec119a37dcc","bb30cc2b302d9a6963109b201b78d4163bb6c2d7bc8bf5a66e9a744b62fc2717","5494909e0f5221db75e933b28981b2d0e118f227b7d8a5980d88b500b76dfc2e","b6912c23cccc4b0964d55608916297f6978f0b38c80a4beac472004a786fcef7","74df77b6a83d89fa137fd285a2efde36b1d62c00b3be81cc93df7d1e6e94837b","a785fc61fc4ff7cff0ddb540bf7ff12111ed0d6031f78f48387a6c16cb3c5451","95cd48130247525d8a7e966bd3fa07e9d6c39ebbe3058ecccb336f66bb8e3d1e","ca8a00c9d36c64e5dcf562c7ae2b8df4bd6455fe0b41b32ee3a2a528ddc2d155","d7745513034af14617436ad6b3fc125fd0343218411d0c79bda56b0dadc86b2b","d384c403c084967d8c967501ee6332b050af04ef424f13a3f5a88d155389d98c","6b7ff061eebeb9ead8812c410247768a7ba90786aeeb1bafa6412cc5b08237b5","739cdedb20de39aeb1f15dc8c2dbbf15fa993250fd879bf87443ff9aeaf4997b","d7c9c9469c513c05aa431fae34f414f91fcf3f794d3e76b6e4d0b92c4cd3ff2e","d7b56818c829960b692de9ad5a14e52669d953e9f074f7218c3fe34ede4a11a0","488d941b7b4428b0f4a0e5495e3857b9b96215fb3e7f164b06640d59096425e6","aa0083f662f055e8d911c5de3a8f3a31b3c84cacc7dccc30c98f2be14dba4102","c7a4a547eb7f6b0b4b75bb6dd8955244bb2618ba234ae740cdedd7c2d30e3465","e88c41a6f769cd760e323b4f7c01835433cd4059cd59630cb1a9eb1181b350ed","613e5314a7ded3155cdec49fd34e852e181f4651d78bd8bf3adad2f4dbf22b0d","330efeebba3782994612fdfe20ff96c930af33a83b88a342b6622461511921b2","6d49233b1fca22f3823e856e4c16749e9c45f384ea57055fead16df35b217226","b830f043076a12748b6a2dc0810ece85439ee77434d991ae7d84201b09ead756","a4f979b4a5d7bc8bc455dd4c09b44e51a389576fccce35a2c8da3ce680237565","7828e17e674507ab13dfd84b31b361fa19b9cb27ee130620ba9211feef746d31","559f46ceb801a3540eace594476718e1486b5b4423cfb4ff64530ff8fb4a3815","a17a972a05afe387ed32aa2986d5be8bca2f22619d0aedfa834c6963abfab3bf","03e6f4f49cec3af38bbec9ed64c195c7a85a630ec989efb3669f04a2993c1dd7","9656d3301f63ef6114289739a1c44082206298f787238fc6c190ad87eab24751","914c18a04a2727bba9cecab78a1d516ec3c7a3f667e0e5a6081aa0e9206a69fe","15489bcd6e4602b41c9a787ec8d7ab027d5e45d400938048bb1c702ad5937980","2b7297a5f502a2e9a59066f0a370bc5a8b28addd0e27975db3d770f801c15397")

Detection Query 7 :

datasourcename = "Windows Security" and eventtype = "4663" AND (((objectname like "%AppData%\Roaming\Microsoft\Windows\Temp" AND objectname IN ("MicrosoftEdgeUpdate.exe","NisSrv.exe","libuv-1.dll","WinRing0x64.sys","mgwthmc2.dat")) OR objectname like "%TEMP%\MicrosoftUpdate.exe") OR objectname like "%StartUp%\FEbJCNWOCKMJ.bat")

Detection Query 8 :

technologygroup = "EDR" AND (((objectname like "%AppData%\Roaming\Microsoft\Windows\Temp" AND objectname IN ("MicrosoftEdgeUpdate.exe","NisSrv.exe","libuv-1.dll","WinRing0x64.sys","mgwthmc2.dat")) OR objectname like "%TEMP%\MicrosoftUpdate.exe") OR objectname like "%StartUp%\FEbJCNWOCKMJ.bat")

Detection Query 9 :

datasourcename = "Windows Security" and eventtype = "4657" AND objectname like "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" AND processname like "\AppData\Roaming\Microsoft\Windows\Temp\NisSrv.exe"

Detection Query 10 :

technologygroup = "EDR" AND objectname like "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" AND processname like "\AppData\Roaming\Microsoft\Windows\Temp\NisSrv.exe"

Detection Query 11 :

datasourcename = "Windows Security" and eventtype = "4688" AND processname like "\schtasks.exe" AND (commandlike like "/create" AND commandlike like "/sc" AND commandlike like "onlogon" AND commandlike like "SystemAgentService" AND commandlike like "NisSrv.exe -s")

Detection Query 12 :

technologygroup = "EDR" AND processname like "\schtasks.exe" AND (commandlike like "/create" AND commandlike like "/sc" AND commandlike like "onlogon" AND commandlike like "SystemAgentService" AND commandlike like "NisSrv.exe -s")