Vidar spyware is now hidden in Microsoft help files
A new cybercrime campaign has been discovered that abuses Microsoft HTML help files to distribute the Vidar malware.
Cybersecurity researchers from Trustwave reported of a threat actor distributing Vidar through an email spam campaign. In it, the attackers would send a relatively generic-looking email, with the attachment file “request.doc”.
That file is not a .doc file, but instead, an .iso disk image, carrying two separate files: a Microsoft Compiled HTML Help file (CHM), often titled pss10r.chm, and an executable file, titled app.exe.
We’re looking at how our readers use VPNs with different devices so we can improve our content and offer better advice. This survey shouldn’t take more than 60 seconds of your time, and entrants from the UK and US will have the chance to enter a draw for a £100 Amazon gift card (or equivalent in USD). Thank you for taking part.
Vidar is described as a Windows spyware and an infostealer, capable of harvesting both user data, and the data on the operating system. It is capable of pulling out cryptocurrency account credentials, as well as payment data, such as credit card details.
The .CHM file format is a Microsoft online extension file, used to access help files. The compressed HTML format allows for the distribution of images, tables and links. But the format can also be abused to load weaponized CHM objects.
In this particular case, the Vidar spyware connects to the command and control (C2) server via Mastodon.
According to business software and services provider Entersoft, Vidar was introduced in December 2018, and is allegedly of Russian origin. The conclusion that the Russians built Vidar was drawn from the fact that the malware stops working if it realizes that it’s operating on an endpoint from an ex-USSR country, or that the keyboard has a Russian layout.
The malware is named after the God of Vengance from Norse mythology – known as Víðarr. It seems to be a variant of the Arkei malware.
As usual, the best way to protect against malware such as this one is to be extra careful when downloading attachments from emails, or clicking on links received in emails from unknown, or unexpected senders.
- Here’s our rundown of the best firewalls right now
Go to Source