The report examines how Vidar has evolved into a multi-stage, fileless attack framework that combines Go-based loaders, VBS, PowerShell, and living-off-the-land binaries to retrieve malicious content concealed inside JPEG and TXT files hosted on a remote IP address. The embedded payloads are extracted, decoded, and executed directly in memory through RegAsm.exe , avoiding disk-based detection. Initial access is delivered through social-engineering lures such as fake GitHub repositories, compromised WordPress sites, and fake CAPTCHA pages. The campaign also relies on Telegram and Cloudflare-fronted domains for command-and-control and data exfiltration.
Point Wild researchers traced the full infection chain from the initial Go-compiled dropper to the final Vidar payload, documenting each layer of obfuscation along the way. Their analysis highlighted the use of custom Base64 markers, reversed strings, and reflective .NET assembly loading to conceal execution. The researchers also described how WScript , PowerShell, and RegAsm.exe were abused as execution proxies, enabling the malware to decode and launch a hidden DLL entirely in memory. Network traffic further confirmed HTTP-based retrieval of staged JPEG and TXT payloads from a hard-coded IP address.
Defenders should focus on detecting the early VBS and PowerShell stages of the infection chain, including suspicious use of RegAsm.exe , retrieval of JPEG or TXT files from the malicious IP, and recognizable Base64 marker patterns. Blocking known malicious domains and IP addresses, monitoring outbound traffic to Telegram, and applying execution controls to common LOLBin utilities can help reduce exposure. Behavior-based detection tuned for fileless execution and in-memory loading techniques is also strongly recommended.
If indicators tied to the Vidar infection chain are identified, isolate the affected host immediately, terminate suspicious processes such as WScript , PowerShell, and RegAsm.exe , and collect memory images for forensic review. The identified IP address and related domains should be blocked, and any startup shortcuts or scheduled tasks used for persistence should be removed. Security teams should also conduct a full credential review focused on exposed browser data, extensions, and cryptocurrency wallets.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
Attack Narrative & Commands:
The chain creates three distinct Sysmon events—each matching the rule’s Image|endswith selector—thereby firing the alert.
Regression Test Script: The script below reproduces the above chain in a safe, sandboxed manner by using harmless echo commands and a dummy DLL (a simple text file) to avoid real malicious activity while still generating the same process‑creation events.
Cleanup Commands: In addition to the cleanup at the end of the script, run the following to ensure no lingering processes or files remain.
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
