Vidar Stealer and XMRig X3D MINER Cracked Software Campaign

Unit 42 documents a financially motivated affiliate, tracked by the operator moniker X3D MINER, running a Vidar stealer malware as a service operation that pairs credential theft with cryptocurrency mining against consumers and small and medium sized businesses across the United States and the European Union. The loaders are produced by a commercial builder framework called Factory-v3, which stamps a unique build into every sample so that no two victims receive an identical binary, a deliberate move to defeat hash based detection and blunt intelligence sharing. The same builder, toolchain, and code signing infrastructure also underpin a concurrent Lumma stealer campaign, which points to a shared criminal supply chain rather than a single bespoke tool.

Access begins with malvertising that steers users searching for pirated or cracked software toward pages serving password protected archives, a packaging choice that frustrates email gateway scanning and automated sandbox detonation. The extracted loader leans heavily on evasion before any payload runs: it carries a rogue code signature that impersonates a recognizable brand so the signing dialog looks reassuring even though the binary is untrusted, and it inflates itself with hundreds of megabytes of null bytes so that size capped sandboxes silently skip it. Once executing, the loader decrypts its embedded configuration and neutralizes in memory scanning by patching the Antimalware Scan Interface so that subsequent script and payload activity is never inspected.

The operator then establishes triple redundant persistence, registering an autostart entry, a logon scheduled task, and a startup script that each relaunch a loader copy renamed to blend in with genuine Windows and Windows Defender components staged in a user writable application data directory. From that foothold the loader delivers two payloads with complementary revenue models: Vidar harvests browser credentials, session cookies, and cryptocurrency wallet material and packages them for exfiltration to attacker infrastructure, while XMRig quietly mines Monero using victim processor time and loads a kernel driver to raise its yield. Victim geolocation and a per host identifier are beaconed to a Telegram channel so the operator can triage fresh logs in real time.

A distinctive tradecraft element is the loader's reuse of Windows Defender service and updater names for its persistence binaries, placing files that carry trusted sounding names in directories where those genuine binaries never live, so that a casual review of running processes or autostart entries reads as routine system maintenance rather than an active compromise.