Vidar Adds Virtual Machine and Custom Stream Ciphers For String Obfuscation
ThreatLabz shows Vidar 2.x and 3.x hide strings with a bytecode virtual machine and custom stream cipher.
Zscaler ThreatLabz analyzed how Vidar versions 2.x and 3.x hide strings. A simple bytecode interpreter uses a 256-entry dispatch table with 14 handlers that mutate a one-byte accumulator using XOR, addition, subtraction, rotation, bitwise negation, multiplication, and substitution. A per-build four-byte value seeds the accumulator and is reused as an XOR key, while opcodes and tables change between builds. The virtual machine either emits the plaintext string or recovers a key and nonce so a custom stream cipher can decrypt it; from version 2.2 the key is the first eight bytes and the nonce is the last four.
- Vidar 2.x and 3.x decode strings with a 14-opcode bytecode virtual machine.
- Handlers use XOR, arithmetic, rotation, negation, multiplication, and substitution.
- Opcodes, constants, and tables change per build around a four-byte XOR key.
- The VM can also recover a key and nonce for a custom stream cipher.
- From version 2.2 the cipher key is eight bytes and the nonce is four bytes.
From the original article
6 min read at zscaler.com
IntroductionVidar is an information stealer that was first observed in 2018. Across its iterations, Vidar has continued to improve its string obfuscation to make detection and analysis more difficult by changing deobfuscation algorithms, constants, and primitives.
By Ismael Garcia Perez (Zscaler) · zscaler.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.