Vidar Uses Custom Bytecode Interpreter and ARX Stream Ciphers for Per-Build String Obfuscation
Vidar stealer now hides strings with a custom bytecode VM and per-build ARX stream ciphers, weakening static detection.
Zscaler ThreatLabz says the Vidar infostealer, tracked since 2018, now hides embedded strings with a minimal custom virtual machine and per-build stream ciphers. From version 2.0 it uses a 14-handler bytecode interpreter; versions 2.0-2.1 use a modified ChaCha design, while 2.2 onward use an ARX cipher incorporating FNV-1a and the constant 0x9E3779B9. Changing opcodes, keys, and constants undermine static YARA matching. Splunk also observed sandbox and endpoint-security checks, and hashes are published for versions 2.0, 2.5, 3.1, and 3.4.
- Vidar 2.0+ decodes strings with a 14-opcode custom bytecode interpreter.
- Each build changes XOR keys, opcodes, constants, and substitution tables.
- Version 2.2 onward uses an ARX cipher with FNV-1a and 0x9E3779B9.
- Zscaler and Splunk say behavior is more durable than string signatures.
- SHA-256 hashes are listed for Vidar 2.0, 2.5, 3.1, and 3.4.
- ATT&CK
- T1027 Obfuscated Files or InformationT1497.001 System ChecksT1518.001 Security Software DiscoveryT1555.003 Credentials from Web Browsers
- Malware
- Vidar
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 1628bb03db87f67661349e169d73ee14ed490bdbf22abfbda08ccc9ebe237974 | signatures. Indicators Of Compromise (IOCs) IOC Description 1628bb03db87f67661349e169d73ee14ed490bdbf22abfbda08ccc9ebe237974 Vidar v2.0 625a381981fc2d4c25c981d98b1d66bb2cf5da2dde2f590a |
| sha256 | 2d43d592630ad1e012da63ef7279f95dd4a8e94964e12ca2f996051875574fa6 | 25c981d98b1d66bb2cf5da2dde2f590add0673a857d5b074 Vidar v2.5 2d43d592630ad1e012da63ef7279f95dd4a8e94964e12ca2f996051875574fa6 Vidar v3.1 979048a749d8f28d877c7068b1b336ecd1e349869dfb1d7c |
| sha256 | 625a381981fc2d4c25c981d98b1d66bb2cf5da2dde2f590add0673a857d5b074 | 61349e169d73ee14ed490bdbf22abfbda08ccc9ebe237974 Vidar v2.0 625a381981fc2d4c25c981d98b1d66bb2cf5da2dde2f590add0673a857d5b074 Vidar v2.5 2d43d592630ad1e012da63ef7279f95dd4a8e94964e12ca2 |
| sha256 | 979048a749d8f28d877c7068b1b336ecd1e349869dfb1d7c68118f90e4099bc4 | 12da63ef7279f95dd4a8e94964e12ca2f996051875574fa6 Vidar v3.1 979048a749d8f28d877c7068b1b336ecd1e349869dfb1d7c68118f90e4099bc4 Vidar v3.4 Note: IP addresses and domains are intentionally |
From the original article
4 min read at gbhackers.com
Vidar information stealer has introduced a lightweight custom virtual machine and per-build stream-cipher variations to conceal its embedded strings, raising the cost of static detection and automated reverse engineering. First observed in 2018, Vidar remains a widely tracked credential-stealing malware family.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.