TrojanSpy.Win32.VIDAR.YXDFTZ

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy drops the following files:

• %ProgramData%\freebl3.dll
• %ProgramData%\mozglue.dll
• %ProgramData%\msvcp140.dll
• %ProgramData%\nss3.dll
• %ProgramData%\softokn3.dll
• %ProgramData%\vcruntime140.dll

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)

It adds the following processes:

• {Malware Path}\{Malware Name}
• %System%\cmd.exe /c timeout /t 6 & del /f /q "{Malware path}" & exit

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Download Routine

This Trojan Spy connects to the following URL(s) to download its configuration file:

• https://{BLOCKED}e:443/headlist
• https://{BLOCKED}ommunity.com/profiles/76561199235044780
• https://{BLOCKED}.{BLOCKED}.{BLOCKED}.250/153ce668f1e21829c936c2b11fa4d869
• https://{BLOCKED}.{BLOCKED}.{BLOCKED}.250/upload.zip

Information Theft

This Trojan Spy gathers the following data:

• Browser Data (e.g. Cookies,History,Autofills,Credentials,Credit Card):
  • Mozilla Firefox
  • Pale Moon
  • Opera
  • Opera Crypto Stable
  • Opera GX Stable
  • Opera Stable
  • Google Chrome
  • Chromium
  • Amigo
  • Torch
  • Vivaldi
  • Comodo Dragon
  • Epic Privacy Browser
  • CocCoc
  • Brave
  • Cent Browser
  • 7Star
  • TOR Browser
  • Chedot Browser
  • Microsoft Edge
  • Microsoft Edge Canary
  • Microsoft Edge Beta
  • Microsoft Edge Dev
  • 360 Browser
  • QQBrowser
  • CryptoTab Browser
  • Thunderbird
• Cryptocurrency Wallet Data:
  • Ethereum
  • Electrum
  • Exodus
  • ElectronCash
  • Multidoge
  • Jaxx Desktop Old
  • Jaxx Desktop
  • Atomic
  • Binance
  • Coinomi
  • Daedalus Mainnet
  • Blockstream Green
  • Wasabi Wallet
  • Bitcoin Core
  • Dogecoin
• Cryptocurrency Browser Extensions:
  • Tronium
  • Trust Wallet
  • Exodus Web3 Wallet
  • Braavos
  • Enkrypt
  • OKX Web3 Wallet
  • Sender
  • Hashpack
  • Eternl
  • GeroWallet
  • Pontem Wallet
  • Petra Wallet
  • Martian Wallet
  • Finnie
  • Leap Terra
  • Microsoft AutoFill
  • Bitwarden
  • KeePass Tusk
  • KeePassXC-Browser
• System Information:
  • Time and Date
  • Version
  • MachineID
  • GUID
  • HWID
  • Malware File Path
  • Work Directory
  • Product Name
  • OS Version and Architecture
  • Install date of OS
  • Antivirus Products
  • Computer Name
  • User Name
  • Dsiplay Resolution
  • Display Language
  • Keyboard Language
  • Local Time
  • Time Zone
• Hardware Information:
  • Processor
  • # of Core
  • # of Threads
  • RAM
  • Video Card
• Runnning Processes
• Installed Software
• Screenshot of current display
• Accounts:
  • Telegram
  • Steam
  • Discord

Stolen Information

This Trojan Spy sends the gathered information via HTTP POST to the following URL:

• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.250

Other Details

This Trojan Spy does the following:

• It terminates itself if any of the following computer name(s) are found in the affected system:
  • JohnDoe
  • HAL9TH
• Drops files in %ProgramData% directory with random names containing the stolen informations then deletes it after exfiltration

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)