Vidar spyware is now hidden in Microsoft help files

Date:
Fri, 25 Mar 2022 14:49:52 +0000

Description:
Vidar is capable of harvesting both user data, and the data on the operating system, experts warn.

FULL STORY ======================================================================

A new cybercrime campaign has been discovered that abuses Microsoft HTML help files to distribute the Vidar malware .

Cybersecurity researchers from Trustwave reported of a threat actor distributing Vidar through an email spam campaign. In it, the attackers would send a relatively generic-looking email , with the attachment file request.doc.

That file is not a .doc file, but instead, an .iso disk image, carrying two separate files: a Microsoft Compiled HTML Help file (CHM), often titled pss10r.chm, and an executable file, titled app.exe. TechRadar needs you!

We're looking at how our readers use VPNs with different devices so we can improve our content and offer better advice. This survey shouldn't take more than 60 seconds of your time, and entrants from the UK and US will have the chance to enter a draw for a 100 Amazon gift card (or equivalent in USD). Thank you for taking part.

Click here to start the survey in a new window <<

The unpacked CHM file triggers a JavaScript snippet which quietly runs the app.exe file. That way, the Vidar malware is loaded onto the target endpoint
.

Vidar is described as a Windows spyware and an infostealer, capable of harvesting both user data, and the data on the operating system. It is
capable of pulling out cryptocurrency account credentials, as well as payment data, such as credit card details.

The .CHM file format is a Microsoft online extension file, used to access
help files. The compressed HTML format allows for the distribution of images, tables and links. But the format can also be abused to load weaponized CHM objects.

In this particular case, the Vidar spyware connects to the command and
control (C2) server via Mastodon. Read more

Chinese tax software hides nasty spyware

What is phishing and how dangerous is it?

Everything you need to know about phishing

According to business software and services provider Entersoft, Vidar was introduced in December 2018, and is allegedly of Russian origin. The conclusion that the Russians built Vidar was drawn from the fact that the malware stops working if it realizes that its operating on an endpoint from
an ex-USSR country, or that the keyboard has a Russian layout.

The malware is named after the God of Vengance from Norse mythology - known
as Varr. It seems to be a variant of the Arkei malware.

As usual, the best way to protect against malware such as this one is to be extra careful when downloading attachments from emails, or clicking on links received in emails from unknown, or unexpected senders. Here's our rundown of the best firewalls right now

Via: ZDNet



======================================================================
Link to news story: https://www.techradar.com/news/vidar-spyware-is-now-hidden-in-microsoft-help-f iles/


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)