Vidar: virtual-machine-based obfuscation
Vidar profileZscaler documented that Vidar started hiding its strings with a method based on a virtual machine and a custom stream cipher. Zscaler
Making malware code, strings or configuration unreadable to make analysis and detection harder.
Obfuscation includes encrypting strings, padding code with meaningless instructions, hiding function names and splitting the payload into layers. The aim is to slow the analyst down and break signatures. MITRE ATT&CK
Because the code has to decode itself while running, obfuscation does not hide behavior; code unpacked in memory becomes visible. MITRE ATT&CK
Server addresses and target file paths are not kept in plain text. MITRE ATT&CK
The code is wrapped in meaningless branches and virtual-machine-like interpreters.
The needed part is unpacked in memory at the moment it is used. MITRE ATT&CK
Zscaler documented that Vidar started hiding its strings with a method based on a virtual machine and a custom stream cipher. Zscaler
Zscaler published a detailed technical analysis of Rhadamanthys’ obfuscation techniques. Zscaler
See your firm's attack surface on one screen: how many findings, at which severity, on which domain.
We use cookies to ensure proper operation of our website, analyze usage, and deliver relevant content and advertisements. You can manage your preferences at any time. Cookie Policy