{"id":14245,"date":"2019-01-04T11:10:03","date_gmt":"2019-01-04T19:10:03","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2019\/01\/04\/news-7997\/"},"modified":"2019-01-04T11:10:03","modified_gmt":"2019-01-04T19:10:03","slug":"news-7997","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2019\/01\/04\/news-7997\/","title":{"rendered":"Vidar and GandCrab: stealer and ransomware combo observed in the wild"},"content":{"rendered":"

Credit to Author: J\u00e9r\u00f4me Segura| Date: Fri, 04 Jan 2019 18:15:25 +0000<\/strong><\/p>\n

We have been tracking a prolific malvertising campaign for several weeks and captured a variety of payloads, including several stealers. One that we initially identified as Arkei turned out to be Vidar, a new piece of malware recently analyzed in detail by Fumik0_<\/a>\u00a0in his post:\u00a0Let\u2019s dig into Vidar \u2013 An Arkei Copycat\/Forked Stealer (In-depth analysis)<\/em><\/a>.<\/p>\n

In\u00a0Norse Mythology,\u00a0V\u00ed\u00f0arr<\/em><\/strong><\/a>\u00a0is a god and son of Odin<\/a>, whose death it is foretold he will avenge. Being referred to as “The Silent One” seems to be fitting for this stealer that can loot\u00a0from browser histories (including Tor Browser) and cryptocurrency wallets, capture instant messages, and much more.<\/p>\n

We witnessed\u00a0a threat actor using the Fallout exploit kit to distribute Vidar. But victims won’t notice that as much, as the secondary and noisier payload being pushed is GandCrab ransomware.<\/p>\n

Overview<\/h3>\n

A malvertising chain leads us to the Fallout exploit kit followed by what we thought was an Arkei stealer. Upon closer look, while the sample did share a lot of similarities with Arkei (including network events), it was actually a newer and, at the time, not yet publicly described piece of malware now identified as Vidar.<\/p>\n

\"\"<\/a><\/p>\n

Beyond Vidar’s stealer capabilities, we also noticed a secondary payload that was retrieved from Vidar’s own command and control (C2) server. The infection timeline showed that victims were first infected with Vidar, which tried to extract confidential information, before eventually being compromised with the GandCrab ransomware.<\/p>\n

Malvertising and Fallout exploit kit<\/h3>\n

Torrent and streaming video sites drive a lot of traffic, and their advertising is often aggressive and poorly-regulated. A malicious actor using a rogue advertising domain is redirecting these site visitors according to their geolocation and provenance to at least two different exploit kits (Fallout EK and GrandSoft EK), although the former is the most active.<\/p>\n

Stealers such as AZORult seem to be the a favorite payload here, but we also noticed that Arkei\/Vidar was quite common. In this particular instance, we saw Vidar being pushed via the Fallout exploit kit.<\/p>\n

\"\"<\/a><\/p>\n

Vidar<\/h3>\n

It should be noted that Vidar is sold as a product, and as such can be\u00a0distributed by several different threat groups through different campaigns.<\/p>\n

\"\"<\/a><\/p>\n

Vidar customers can customize the stealer via profiles, which gives them a way to adjust which kind of data they are interested in. Beyond the usual credit card numbers and other passwords stored in applications, Vidar can also scrape an impressive selection of digital wallets.<\/p>\n

\"\"<\/a><\/p>\n

Upon execution on the system, Vidar will search for any data specified in its profile configuration and immediately send it back to the C2 server via an unencrypted HTTP POST request.<\/p>\n

This includes high level system details (specs, running processes, and installed applications) and stats about the victim (IP address, country, city, and ISP) stored in a file called\u00a0information.txt<\/em>. This file is packaged along with other stolen data and zipped before being sent back to the C2 server.<\/p>\n

\"\"<\/p>\n

GandCrab as a loader<\/h3>\n

Vidar also offers to download additional malware via its command and control server. This is known as the loader feature, and again, it can be configured within Vidar’s administration panel by adding a direct URL to the payload. However, not all instances of Vidar (tied to a profile ID) will download an additional payload. In that case, the server will send back a response of “ok” instead of a URL.<\/p>\n

HTTP\/1.1 200 OK  Date:   Content-Type: text\/html; charset=UTF-8  Connection: keep-alive  Server: Pro-Managed  Content-Length: 51    http:\/\/ovz1.fl1nt1kk.10301.vps.myjino[.]ru\/topup.exe;<\/pre>\n
Within about a minute after the initial Vidar infection, the victim’s files will be encrypted and their wallpaper hijacked to display the note for GandCrab version 5.04.<\/p>\n
\"\"<\/a><\/p>\n
Ransomware as a last payload<\/h3>\n
While ransomware experienced a slowdown in 2018, it is still one of the more dangerous threats. In contrast to many other types of malware, ransomware is instantly visible and requires a call to action, whether victims decide to pay the ransom or not.<\/p>\n
However, threat actors can use ransomware for a variety of reasons within their playbook. It could be, for instance, a simple decoy where the real goal is to irreversibly corrupt systems without any way to recover lost data. But as we see here, it can be coupled with other threats and used as a last payload when other resources have already been exhausted.<\/p>\n
As a result, victims get a double whammy. Not only are they robbed of their financial and personal information, but they are also being extorted to recover the now encrypted data.<\/p>\n
Malwarebytes users are protected against this threat at multiple levels. Our signatureless anti-exploit engine mitigates the Internet Explorer and Flash Player exploits delivered by the Fallout exploit kit. We detect the dropped stealer as Spyware.Vidar and also thwart GandCrab via our anti-ransomware module.<\/p>\n
Acknowledgements<\/h3>\n
Many thanks to\u00a0Fumik0_<\/a>\u00a0and\u00a0@siri_urz<\/a> for their inputs and Vidar payload identification.<\/em><\/p>\n
Indicators of Compromise (IOCs)<\/h3>\n
Vidar binary<\/p>\n
E99DAF10E6CB98E93F82DBE344E6D6B483B9073E80B128C163034F68DE63BE33<\/pre>\n
Vidar C2<\/p>\n
kolobkoproms[.]ug<\/pre>\n
Loader URL (GandCrab)<\/p>\n
ovz1.fl1nt1kk.10301.vps.myjino[.]ru\/topup.exe<\/pre>\n
GandCrab binary<\/p>\n
ABF3FDB17799F468E850D823F845647738B6674451383156473F1742FFBD61EC<\/pre>\n
The post Vidar and GandCrab: stealer and ransomware combo observed in the wild<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n
https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Credit to Author: J\u00e9r\u00f4me Segura| Date: Fri, 04 Jan 2019 18:15:25 +0000<\/strong><\/p>\n\n\n\n
<\/a><\/td>\n<\/tr>\n
Threat actors combine new stealer Vidar and GandCrab ransomware in one-two punch.<\/p>\n
Categories: <\/p>\n