[March | Malware Analysis Report] Vidar Infostealer Targeting Korean Businesses: Indications of Links to APT28

The SANDS Lab Threat Analysis Team selects malware each month and prepares a report.

Through expert analysis, we share malware characteristics, threat trends, and related intelligence to help create a safer cyber environment.

More detailed information on malware is available through our cyber threat intelligence service, <CTX>.

1. Overview

This report provides a detailed analysis of Vidar infostealer malware, which steals personal and financial information.

First emerging around 2018, Vidar has continually evolved and enhanced its capabilities. It is now distributed on the dark web as Malware as a Service (MaaS). Initially known as a derivative of the Arkei Trojan, it developed into an architecture optimized for collecting and exfiltrating sensitive data from browsers, cryptocurrency wallets, FTP clients, and cloud platform credentials. It has recently expanded its reach to sophisticated theft of authentication tokens from platforms such as Steam and Discord.

Vidar uses legitimate web services such as Telegram channels and Steam profiles as C2 relay points to dynamically retrieve C2 addresses in real time. Attackers can thus easily replace C2 infrastructure without redistributing the malware, effectively bypassing security blocks. The analyzed sample follows this approach and was distributed to Korean users using Korean file names and document icons. It masquerades as a legitimate executable with an Extended Validation (EV) code signature to avoid suspicion, then uses process hollowing to conceal its payload in a child process, further hindering detection and analysis.

Notably, the analyzed sample shares infrastructure with a domain used by the Russia-linked APT28 group to send malicious emails and retrieve exfiltrated data through compromised routers. This raises the possibility of a sophisticated APT-level threat beyond ordinary MaaS use. Accordingly, this report examines Vidar’s overall architecture, attack methods, detection-evasion techniques, and connections to APT28 to help inform responses to similar future threats.

2. Malware Information

The malware was distributed with names such as “파손사진 주문서(파손상태가 많이 안좋습니다 확인부탁드립니다).exe” and “저작권 관련 이미지 아이콘 UI 사용 내역.exe,” using a Hangul word processor icon to trick users into opening what appeared to be a document. In particular, it was attached to emails targeting Korean online sellers, claiming that products were damaged and requesting assistance to entice recipients to execute the malicious file.

[Figure 1] Malicious file icon

Written in Go, the malware internally runs Setup.exe without any obvious abnormal behavior. Go supports cross-compilation for Windows, Linux, and macOS. Compared with conventional C-based malware, it has fewer analysis precedents and lower compatibility with analysis tools, making detection and static analysis more difficult. This provides attackers with an environment for more covert distribution and operation.

Setup.exe includes an EV code signature issued to “NEW VECTOR LTD,” used to evade security detection and encourage user trust. It includes a legitimate certificate chain issued by DigiCert, with a signing date of February 11, 2025. However, the certificate is no longer valid and was confirmed to have been revoked by the certification authority (SSL.com).

[Figure 2] Certificate information with an unverifiable digital signature

The malware runs without visible signs of compromise while collecting browser data, cryptocurrency wallets, system information, and other sensitive data in the background and transmitting them to an external C2 server. Process hollowing conceals the payload in a child process, complicating analysis and enabling continued malicious activity.

3. Malware Execution Flow

Initial infection occurs through an executable disguised as a document. When a victim runs it, the malware creates an identical child process and injects an internally decompressed payload using process hollowing, allowing malicious activity to continue concealed while evading detection.

The injected process then initializes itself to receive attacker commands. Using legitimate platforms such as Telegram and Steam Community as relay points, it retrieves the actual C2 address. It visits hardcoded Telegram and Steam profile links and parses their HTML for the keyword “ir7am” to extract the address. Attackers can thereby change C2 addresses at any time without redistributing the malware.

Once the C2 address is obtained, the malware exfiltrates information collected from the infected system, including browser data, cryptocurrency wallets, system information, and cloud credentials. An asynchronous transmission routine sends the collected data to the extracted C2 address.

[Figure 3] Malware execution flow

4. Malware Analysis

4.1. Loading and Executing the Malicious Payload in Memory

Executing the distributed malware decompresses its embedded payload and loads it into memory. It creates a child process with the same name as the executable and injects the payload using process hollowing, concealing malicious activity and bypassing security detection.

[Figure 5] Hex dump of the extracted malicious payload

4.2. Obtaining and Connecting to the C2 Server Address

To receive attacker commands, the malware dynamically retrieves the actual C2 address using legitimate platforms (Steam Community and Telegram channels) as relay servers. The procedure is as follows.

First, it constructs an array of hardcoded Telegram and Steam Community URLs.

Each entry consists of a Telegram channel or Steam Community profile link, a keyword, and a User-Agent string.

The array contains the following.

- Telegram/Steam Community: https://t.me/l793oy, https://steamcommunity.com/profiles/76561199829660832

- Keyword: ir7am

- User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/131.0.0.0 Safari/537.36 OPR/116.0.0.0

[Figure 6] Hardcoded URL pair

Second, it iterates through the URL list, sends HTTP requests to each address, and analyzes the responses.

It parses the returned HTML for the actual C2 address alongside the keyword “ir7am.” Analysis identified https://b.b.goldenloafuae.com on the Telegram page and https://116.202.4.223 on the Steam Community page as the actual C2 addresses.

[Figure 7] Actual C2 addresses in Telegram and Steam profiles

Using legitimate platforms as relays helps evade security detection and lets the attacker switch C2 servers simply by editing the platform content, without redistributing the malware.

4.3. Collecting Victim System Information

The malware collects a broad range of sensitive information from infected systems.

It collects system information including program version, GUID, HWID, executable path and working directory, Windows installation details, installed antivirus software, computer and user names, screen resolution, keyboard language, system time, and time zone. Hardware details include processor type, core and thread counts, and memory capacity. It also collects running processes and installed-program information from HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER, allowing the attacker to understand the complete system configuration and usage environment. The data is stored in memory as information.txt, compressed and encrypted, and sent to the C2 server.

[Figure 8] Decrypted system information transmitted to the actual C2 server

4.4. Stealing Browser Data

The malware searches browser profile directories to steal user data.

Its main targets are Cookies, Web Data, and History files, located using environment variables such as %LOCALAPPDATA% and %APPDATA% along with user path information.

Using FindFirstFileA() and FindNextFileA(), it searches profile directories for target files. Discovered files are loaded into memory and sent to the C2 server after compression and encryption under names such as _cookies.db, _webdata.db, and _history.db. Stolen cookies and session information can allow direct access to victims’ online accounts without additional authentication, posing serious privacy and financial risks.

[Figure 9] Browser data transmitted to the actual C2 server

4.5. Stealing File Transfer Client Credentials

4.5.1. Stealing FileZilla FTP Credentials

The malware locates recentservers.xml, which stores FileZilla connection history on the local system, extracts FTP login information, and exfiltrates it.

It first loads \AppData\Roaming\FileZilla\recentservers.xml under %APPDATA% into memory. It then parses the XML using strtok_s() and tags such as <Host>, <Port>, <User>, and <Pass encoding="base64"> to extract the FTP server address, port, username, and password.

Because FileZilla stores passwords as base64-encoded values in its configuration file, the malware uses a built-in base64 decoder to restore plaintext. The extracted credentials are formatted with the text “Soft: FileZilla,” then compressed and encrypted as passwords.txt and sent to the external C2 server.

[Figure 10] Formatting code for exfiltrated FileZilla credentials

FileZilla is a widely used FTP client. Stolen credentials can grant attackers unauthorized access to FTP servers managed or accessible by the victim, potentially leading to web server compromise, backdoor installation, or website defacement.

4.5.2. Stealing WinSCP Session Credentials

The malware collects and exfiltrates WinSCP login information through the Windows registry. WinSCP stores session settings at HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions, which the malware examines for each user’s saved FTP/SFTP connection information.

It first checks whether WinSCP uses a master password and collects sessions only if none is set. It then enumerates session keys and extracts the following information from each.

- HostName: Server address

- PortNumber: Port number (defaults to 22 if absent)

- UserName: Login account

- Password: Saved password

The credentials are formatted with the text “Soft: WinSCP,” then compressed and encrypted as passwords.txt and sent to the external C2 server.

[Figure 11] Formatting code for exfiltrated WinSCP credentials

4.6. Stealing Monero Cryptocurrency Wallet Files

The malware collects Monero wallet information from infected systems and exfiltrates it.

It opens HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core in the Windows registry and queries the wallet_

path value to identify the user’s Monero wallet location. This usually contains a .keys wallet key file holding sensitive information such as the wallet’s private key. The malware constructs the full .keys path, copies the file, compresses and encrypts it, and sends it to the C2 server.

4.7. Stealing Steam Account and Configuration Information

4.7.1. Stealing Steam JWT Tokens

To steal Steam authentication information, the malware searches memory for JWTs (JSON Web Tokens), collects them, and exfiltrates them. It identifies the running steam.exe process ID (PID) and scans its virtual memory sequentially for “eyAidHlwIjogIkpXVCIs,” a base64-encoded common JWT header that decodes to { "typ": "JWT",. The code looks for the byte sequence 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 and reads surrounding memory blocks. It then checks for “N0ZWFt” in the block and treats matches as valid JWTs. Extracted tokens are compressed, encrypted, and sent to the C2 server.

[Figure 13] Code searching process memory for JWT headers

Steam uses JWTs signed with EdDSA (Edwards-curve Digital Signature Algorithm) for authentication and session persistence. These tokens identify login status and maintain authenticated sessions. A stolen JWT can let an attacker impersonate a user without a separate login, potentially leading to unauthorized account access, account takeover, or item theft.

4.7.2. Stealing Steam Configuration Files

The malware finds and steals key Steam client configuration files and sends them to the attacker’s C2 server. It queries “SteamPath” at HKEY_CURRENT_USER\Software\Valve\Steam to determine the installation path, then locates the config directory containing the configuration files.

[Figure 14] Code setting paths for Steam configuration file searches

It then searches by name patterns for sensitive files such as config.vdf, DialogConfig.vdf, DialogConfigOverlay*.vdf, libraryfolders.vdf, and loginusers.vdf. Located files are loaded into memory, compressed and encrypted, and sent to the C2 server.

In particular, loginusers.vdf contains Steam automatic-login information that can enable direct access to the victim’s account. libraryfolders.vdf and config.vdf also reveal details such as installed games and configuration settings.

4.8. Stealing Discord Authentication Tokens

The malware collects authentication tokens from the victim’s local Discord storage and exfiltrates them.

It uses Discord’s LevelDB and Local State files together to decrypt AES-encrypted tokens before transmission. After obtaining %APPDATA%, it checks for \discord\Local Storage\leveldb\CURRENT to determine whether Discord is installed. If the path exists, it targets .ldb and .log files in the leveldb directory.

[Figure 15] Code setting the CURRENT path in Discord’s LevelDB directory

It then accesses %APPDATA%\discord\Local State and extracts the stored AES-GCM key, which decrypts authentication tokens in the previously copied leveldb files. The fixed marker “dQw4w9WgXcQ” identifies token strings; base64 decoding and AES decryption recover plaintext tokens. These are assembled in memory as token*.txt, compressed and encrypted, and sent to the C2 server.

[Figure 16] Discord token identification code

4.9. Stealing Cloud Credentials

The malware searches the victim’s system for cloud service credential files and exfiltrates them to the C2 server.

Its primary targets are Microsoft Azure and Amazon Web Services (AWS), as well as the Microsoft IdentityService directory that stores Windows authentication information. These store credentials such as access keys, configuration files, and tokens in standard local directories, which the attacker searches for exfiltration.

The malware focuses on the following three directories.

- Azure CLI authentication directory: %USERPROFILE%\.azure\

This stores authentication information and related files for users logged in through Azure CLI. The malware recursively collects files and sends them to the C2 server.

- AWS CLI authentication directory: %USERPROFILE%\.aws\

This contains AWS CLI configuration files (credentials and config). Files holding sensitive information such as Access Key IDs and Secret Access Keys are found and exfiltrated in the same way.

- Microsoft IdentityService directory: %LOCALAPPDATA%\.IdentityService\

This stores Microsoft account and Azure AD authentication tokens and caches. It is also searched recursively to collect and exfiltrate important credentials.

[Figure 17] Code identifying directories to search

Discovered files are compressed, encrypted, and sent to the C2 server.

The stolen credentials can enable unauthorized access to victims’ cloud resources or serve as a foothold for further attacks.

4.10. Capturing and Exfiltrating Screenshots

The malware captures the victim’s entire screen, converts it to JPEG, and sends it to the external C2 server.

Using the GDI+ (Graphics Device Interface+) library, it first initializes the environment through InitializeGDIPlus(), then finds and configures a JPEG image encoder.

GetDesktopWindow() and GetWindowRect() determine the full screen dimensions. GetDC(), CreateCompatibleDC(), and CreateCompatibleBitmap() then create a memory device context (DC) and bitmap. BitBlt() copies the actual screen content into the memory DC to obtain the screenshot.

[Figure 18] Screen capture code

A memory stream is created and the captured image is saved to it using the selected JPEG encoder. The resulting image is transmitted to the C2 server as screenshot.jpg.

4.11. Downloading and Executing Remote Malicious Payloads

The malware downloads malicious payloads from a remote server and executes them on the victim’s system. It stores them in C:\ProgramData\, selecting the extension according to a stack value received through C2 communication: 0 selects .exe and 1 selects .dll.

[Figure 19] File extension selection code

It decrypts the URL received from the C2 server, downloads the remote payload, and saves it at the configured path. Once downloaded, the file is immediately executed through ShellExecuteExW(). An .exe runs directly, while a .dll runs through rundll32.exe, which indirectly invokes a specified export function. This can bypass process-based detection by security solutions.

[Figure 20] Code specifying rundll32.exe

This provides flexibility to expand malicious activity or remotely download and run additional payloads as needed. The victim’s system may therefore remain exposed to further threats, while these evasion techniques make accurate detection and response more difficult.

4.12. Removing Traces of Malicious Activity

After completing its activity, the malware invokes cmd.exe to execute commands that remove traces from the system.

The command launched through ShellExecuteExA() first waits 11 seconds using /c timeout /t 11, then deletes data through one of two branches. One uses rd /s /q "C:\ProgramData\Data\" & exit to remove the entire folder. The other adds del /f /q * to forcibly delete files before removing the directory.

The deletion target is fixed at C:\ProgramData\Data\, the folder used for malicious activity.

This explicit directory-removal routine before termination appears designed to minimize disk traces and hinder analysis. The delay allows the running malicious process to terminate fully before its files are deleted, demonstrating deliberate design.

[Table 1] Shell commands for removing traces

5. Collected / Exfiltrated Information

[Table 2] Collected / exfiltrated information

6. Conclusion

The analyzed malware belongs to the Vidar infostealer family and was distributed to Korean users using Hangul document icons and Korean file names.

It specifically targeted Korean online sellers through emails requesting confirmation of product damage. An EV code signature made it appear legitimate, encouraging execution and evading security detection. Once launched, it creates a same-named child process and uses process hollowing to hide its payload in memory while performing malicious activity in the background.

For C2 communication, it uses legitimate platforms such as Telegram and Steam Community as relays, parsing the HTML of hardcoded links for a keyword to retrieve current C2 addresses. This allows attackers to replace C2 servers without redistributing the malware and effectively bypass detection and blocking.

It collects a wide range of data, including browser information, FTP client settings, Steam and Discord account information, cryptocurrency wallets, and cloud credentials. Sophisticated techniques directly decrypt and extract Steam JWTs and Discord AES-GCM-encrypted tokens in memory. It also includes spyware capabilities to capture and exfiltrate screenshots, remote payload download and execution, and final-stage concealment that automatically deletes files and directories.

The analyzed malware used b.b.goldenloafuae.com as C2 infrastructure. This domain belongs to the real UAE bakery brand “Golden Loaf,” suggesting its server or domain information was compromised. goldenloafuae.com was previously used by the Russia-linked APT28 group to send malicious emails and retrieve exfiltrated data through compromised routers, suggesting possible links between this malware and APT28 activity. Hijacking legitimate business domains enables attackers to disguise malicious traffic as normal traffic and bypass detection.

[Figure 21] goldenloafuae.com domain used by APT28

Distributed as MaaS, Vidar allows different attackers to share the same payload and change only C2 details. However, evidence of reused APT infrastructure in this case supports the possibility of a sophisticated attack on specific countries and industries rather than routine tool use. Warnings about “product damage confirmation” emails have recently spread in online communities frequented by actual victims, indicating real harm to Korean online sellers. Similar threats are likely to recur, underscoring the need for continuous threat intelligence sharing and stronger multilayer defenses to protect Korean businesses and users.