kaandemir993/vidar-stealer-chrome-injection-malicious-js-targeting-google-reddit-sessions-analysisReverse engineering Vidar Stealer: From obfuscated memory strings to Chrome process injection, malicious JS execution, and active session hijacking on Google & Reddit.
The Vidar Stealer sample loaded in Binary Ninja displays heavily obfuscated code within the main.vxormo function. The analysis reveals that the malware relies on string encryption, custom XOR routines, and runtime memory assembly to hide its true behavior. The \x00-heavy byte arrays (x00\x00\x00...) in the pseudo-C view indicate that raw payload fragments are being constructed directly in memory.
Obfuscated Functions: Randomly generated names like main.vxormo, main.oqvmwusz, and main.dzgsnuhm are used to obscure functionality. Obfuscated Strings: whatnthotsfalse... and cornbindtrue... are encrypted strings that are resolved at runtime. Custom XOR Routine: The vxormo function name itself suggests a custom XOR decryption loop is active. In-Memory Payload Construction: Arrays containing \x00, \x89, \x99, \x48 bytes are being written to memory using _builtin_memcpy.The uint8_t)rax pointer shows raw shellcode/payload fragments being assembled.
Defeating Static Analysis: The use of randomly named functions and encrypted strings means static signature-based AVs will fail to identify the payload. In-Memory Execution (Fileless): The \x00 payload is never dropped to disk; it is allocated and executed directly in memory (RWX), evading file scanners. Custom XOR Encryption: A custom XOR routine prevents simple string extraction or YARA rule matching. Data Hiding: The massive, unreadable arrays (\x00\x00\x00\x01...) are likely encrypted configuration blocks (C2 URLs, grabber modules) that are decrypted only when needed.
A second view of the Vidar Stealer sample in Binary Ninja reveals a function (main.obttcklrlfwpzvugbzqtn) dedicated to system reconnaissance and anti-forensic cleanup. The function processes encrypted strings and resolves API names to wipe traces of its execution, specifically targeting DNS caches, event logs, and temporary internet files before dropping the final payload.
Obfuscated API Resolution: The string ...DiednsQuery_WGGetIfEntryCancelIoExCreatePipe... is an encrypted concatenation of WinAPI calls Cleanup APIs Identified: DnsQuery_W / DnsFlushResolverCache – flushes DNS cache to hide C2 domain resolution traces. GetIfEntry– enumerates network interfaces (checking for sandbox/virtual adapters). WinExec – dynamically executes system cleanup utilities (e.g., cmd.exe /c del ...). Syscall/Script Execution: References to dllws2_32.dll and /dev/stdin (standard input redirection) indicate the malware prepares to interact with the system's standard streams or network stack.
Anti-Forensics: Flushing the DNS cache (DnsFlushResolverCache) and invoking cleanup routines ensures that network logs and local artifacts are destroyed, hindering incident response. Sandbox Evasion: Querying network interfaces (GetIfEntry) allows the stealer to detect virtualized environments (e.g., VMware, VirtualBox) and abort execution if a sandbox is detected Spoofing Execution Flow: Using WinExec for cleanup means the malware doesn't need to statically import deletion APIs; it delegates the dirty work to the OS. Fileless Interaction: /dev/stdin redirection and pipe usage (CreatePipe) allow the stealer to pass stolen data to an injected process or a command shell without touching the disk.
The Process Hacker memory view of the chrome.exe process (PID 8944) confirms that the Vidar Stealer has injected its payload directly into the browser's memory space. The string scan exposes multiple thread execution blocks, a standard artifact of process hollowing or remote thread injection. By injecting into Chrome, the stealer operates under a trusted, high-integrity process to silently harvest cookies, saved credentials, and session tokens.
Injected Threads (Memory Strings): THREAD_BROWSER_WATCHDOG / THREAD_GPU_WATCHDOG – watchdogs hijacked to keep the injected threads alive. THREAD_CACHE_BLOCKFILE – indicates manipulation of Chrome's cache (likely for extracting session data). THREAD_AUDIO_INPUTDEVICE / THREAD_GAMEPAD_POLLING – non-essential threads repurposed to mask malicious activity. THREAD_WEBCRYPTO – highly suspicious; Chrome's internal crypto API is used to decrypt saved passwords and cookies. THREAD_PROXYRESOLVER / THREAD_DATABASE – used to intercept network traffic and access the local credential database.
Browser Credential Theft: Hooking THREAD_WEBCRYPTO and THREAD_DATABASE allows Vidar to bypass Chrome's encryption and steal saved passwords and cookies. Living off the Land: By injecting into chrome.exe, the malware masquerades as legitimate browser traffic, easily bypassing firewalls and EDR network rules. Process Hollowing: The presence of standard Chrome threads alongside injected ones means the malware likely hollowed a legitimate thread or used CreateRemoteThread. Session Hijacking: THREAD_CACHE_BLOCKFILE and cookie extraction allow the attacker to steal active sessions (session hijacking) without needing the user's password. Evasion: Antivirus solutions rarely scan inside the memory space of a signed browser like Chrome.
A deeper look into the injected memory space of chrome.exe (PID 8944) reveals a collection of strings specifically targeting Google authentication flows, Reddit sessions, and browser JavaScript execution. The presence of these strings confirms that the Vidar Stealer injects malicious JavaScript or hooks browser APIs to intercept login credentials and session tokens.
Credential / Authentication Targets: accounts.google.com – specifically targets Google account login pages for credential theft. https://www.reddit.com/notifications – monitors Reddit session activity (likely cookie theft). Gelen Kutusu (Turkish for "Inbox") – indicates targeting of email or messaging interfaces. toDashCase / MemoryInfra / BackForwardCacheCSIgnoreUnc... – Chrome's internal memory and rendering flags AutoFillEnableExpandIframeRegexPatt... – manipulation of Chrome's AutoFill functionality to capture saved passwords/forms Multiple text/javascript: entries confirm that Vidar is injecting and executing malicious JavaScript directly within the browser context. ResourcePool / sfsssqcxxwqecaddbbbcqpvadzvwrze – likely an encrypted C2 endpoint or randomly generated session identifier.
