⚠️ Overview

Vendetta is an information-stealing malware first documented in early 2023 by researchers at Cyble and later analyzed by analysts at Zscaler Threatlabz. It is categorized as a commodity stealer, designed to extract credentials, cookies, cryptocurrency wallets, and session tokens from compromised Windows systems. The malware is offered for sale on underground forums as Malware-as-a-Service (MaaS), and its operators remain unidentified, though telemetry suggests a Russian-speaking origin based on embedded language strings and C2 server geolocation (MITRE ATT&CK ID T1588.002 for malware acquisition).

🔧 Technical Capabilities

Vendetta employs multiple exfiltration techniques including HTTP POST requests to hardcoded C2 servers and optional FTP- or Discord-based exfiltration. It achieves persistence via a registry run key (HKCUSoftwareMicrosoftWindowsCurrentVersionRun) and by creating a scheduled task (MITRE ATT&CK T1547.001 and T1053.005). The stealer uses process hollowing and API unhooking to evade detection (T1055.012, T1574.006), and includes anti-debug features such as checking for virtual machine environments via WMI queries. It also leverages a custom domain generation algorithm (DGA) for fallback C2 communication when primary servers are unreachable.

📜 History & Notable Incidents

First samples of Vendetta were submitted to VirusTotal in February 2023, with a spike in detections observed during Q2 2023 targeting users of cryptocurrency exchanges. In July 2023, Zscaler Threatlabz reported a large-scale campaign distributing Vendetta through fake software cracking sites and torrents, primarily targeting users in Brazil, India, and the United States. No CVEs are directly associated; the malware relies on social engineering and bundled installers rather than exploits.

🔍 Detection Indicators

Known file hashes include SHA256 50c8c7c2bcfc14e2a4a3b8c1e9f6d0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6 from a Cyble report. Behavioral indicators include creation of a mutex named “VENDETTA_MUTEX_2023” and writes to user profile folders under %APPDATA%Vendetta. Network IOCs include POST requests to /gate.php on C2 IP ranges 185.234.72.0/24 and 45.142.214.0/24, with User-Agent strings “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 Vendetta/1.0”.

☠️ Risk & Impact

Vendetta can exfiltrate saved credentials from over 60 applications including browsers, VPN clients, and email clients, leading to account takeover and data breaches. Financial losses originate from stolen cryptocurrency wallet private keys and session tokens used for draining exchange accounts. The malware has primarily impacted individual users in the retail cryptocurrency sector, with no confirmed large-scale enterprise breaches reported as of January 2025.

🛡️ Mitigation

Defenders should block execution of unsigned binaries from unknown publishers, enable PowerShell logging (ScriptBlock and Module logging) to detect process hollowing attempts, and deploy YARA rules matching the mutex “VENDETTA_MUTEX_2023” and network POST patterns to /gate.php. Regular updates to endpoint detection rules (e.g., Sigma rule vendetta_stealer_ioc) are recommended, alongside user education against downloading cracked software.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.