SYMBOLCOMMON_NAMEaka. SYNONYMS
win.vidar (Back to overview)

Vidar

VTCollection    

Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.

References
2025-03-23 ⋅ AviaB ⋅ AviaB
Analyzing Vidar Stealer
Vidar
2024-10-17 ⋅ Loader Insight Agency ⋅ LIA
Correlating Vidar Stealer Build IDs Based on Loader Tasks
Lumma Stealer SmokeLoader Vidar
2024-07-22 ⋅ Censys ⋅ Censys, Embee_research
A Beginner’s Guide to Hunting Malicious Open Directories
Cobalt Strike Lumma Stealer Vidar
2024-07-02 ⋅ Sekoia ⋅ Quentin Bourgue
Exposing FakeBat loader: distribution methods and adversary infrastructure
BlackCat Royal Ransom EugenLoader Carbanak Cobalt Strike DICELOADER Gozi IcedID Lumma Stealer NetSupportManager RAT Pikabot RedLine Stealer SectopRAT Sliver SmokeLoader Vidar
2024-06-10 ⋅ Mandiant ⋅ Mandiant
UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion
Lumma Stealer MetaStealer Raccoon RedLine Stealer RisePro Vidar UNC5537
2023-12-15 ⋅ ⋅ Gatewatcher ⋅ Gatewatcher
Utilisation de faux profils Steam : Vidar Stealer prend les commandes
Vidar
2023-12-06 ⋅ Twitter (@embee_research) ⋅ Embee_research
Ghidra Basics - Identifying, Decoding and Fixing Encrypted Strings
Vidar
2023-11-30 ⋅ Medium g0njxa ⋅ g0njxa
Approaching stealers devs : a brief interview with Vidar
Vidar
2023-11-21 ⋅ Censys ⋅ Aidan Holland
Tracking Vidar Infrastructure with Censys
Vidar
2023-11-16 ⋅ CISA ⋅ CISA
Scattered Spider
BlackCat Ave Maria Raccoon Vidar
2023-11-16 ⋅ CISA ⋅ CISA
Scattered Spider
Ave Maria BlackCat Raccoon Vidar
2023-10-27 ⋅ Elastic ⋅ Joe Desimone, Salim Bitam
GHOSTPULSE haunts victims using defense evasion bag o' tricks
HijackLoader Lumma Stealer NetSupportManager RAT Rhadamanthys SectopRAT Vidar
2023-10-25 ⋅ Viuleeenz ⋅ Alessandro Strino
Vidar - payload inspection with static analysis
Vidar
2023-10-12 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Spamhaus Botnet Threat Update Q3 2023
FluBot AsyncRAT Ave Maria Cobalt Strike DCRat Havoc IcedID ISFB Nanocore RAT NjRAT QakBot Quasar RAT RecordBreaker RedLine Stealer Remcos Rhadamanthys Sliver Stealc Tofsee Vidar
2023-07-24 ⋅ M4lcode ⋅ Mostafa Farghaly
Deep Analysis of Vidar Stealer
Arkei Stealer Vidar
2023-06-15 ⋅ Team Cymru ⋅ S2 Research Team
Darth Vidar: The Aesir Strike Back
Vidar
2023-05-16 ⋅ Secureworks ⋅ Counter Threat Unit ResearchTeam
The Growing Threat from Infostealers
Graphiron GraphSteel Raccoon RedLine Stealer Rhadamanthys Taurus Stealer Vidar
2023-05-09 ⋅ eSentire ⋅ RussianPanda
eSentire Threat Intelligence Malware Analysis: Vidar Stealer
Vidar
2023-04-12 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Spamhaus Botnet Threat Update Q1 2023
FluBot Amadey AsyncRAT Aurora Ave Maria BumbleBee Cobalt Strike DCRat Emotet IcedID ISFB NjRAT QakBot RecordBreaker RedLine Stealer Remcos Rhadamanthys Sliver Tofsee Vidar
2023-03-30 ⋅ eSentire ⋅ eSentire Threat Response Unit (TRU)
eSentire Threat Intelligence Malware Analysis: BatLoader
BATLOADER Cobalt Strike ISFB SystemBC Vidar
2023-03-09 ⋅ eSentire ⋅ eSentire Threat Response Unit (TRU)
BatLoader Continues to Abuse Google Search Ads to Deliver Vidar Stealer and Ursnif
BATLOADER ISFB Vidar
2023-02-20 ⋅ 0xToxin Labs ⋅ @0xToxin
Vidar Stealer H&M Campaign
Vidar
2023-02-06 ⋅ Quorum Cyber ⋅ Quorum Cyber
Malware Analysis Report Vidar - Stealerware
Vidar
2023-02-03 ⋅ Cloudsek ⋅ Deepanjli Paulraj, Pavan Karthick M
Threat Actors Abuse AI-Generated Youtube Videos to Spread Stealer Malware
Alfonso Stealer Bandit Stealer Cameleon Fabookie Lumma Stealer Nanocore RAT Panda Stealer RecordBreaker RedLine Stealer Stealc STOP Vidar zgRAT
2023-02-02 ⋅ YouTube (SLEUTHCON) ⋅ Christopher Glyer, Microsoft Threat Intelligence Center (MSTIC)
Lions, Tigers, and Infostealers - Oh my!
RecordBreaker RedLine Stealer Vidar
2023-01-31 ⋅ Darktrace ⋅ Roberto Martinez
Vidar Info-Stealer Malware Distributed via Malvertising on Google
Vidar
2023-01-24 ⋅ Fortinet ⋅ Geri Revay
The Year of the Wiper
Azov Wiper Bruh Wiper CaddyWiper Cobalt Strike Vidar
2023-01-19 ⋅ Emerging Threats ⋅ Isaac O'Shaughnessy
Vidar Stealer Picks Up Steam!
Vidar
2023-01-19 ⋅ Team Cymru ⋅ S2 Research Team
Darth Vidar: The Dark Side of Evolving Threat Infrastructure
Vidar
2023-01-12 ⋅ Cynet ⋅ Kindra Cantrell
CyOps Lighthouse: Vidar Stealer
Vidar
2022-12-31 ⋅ Jaalma's Blog ⋅ Jaalma
Analyzing a VIDAR Infostealer Sample
Vidar
2022-12-17 ⋅ kienmanowar Blog ⋅ m4n0w4r, Tran Trung Kien
[QuickNote] VidarStealer Analysis
Vidar
2022-12-13 ⋅ Kroll ⋅ Dave Truman, George Glass, Keith Wojcieszek, Stephen Green
Threat Actors use Google Ads to Deploy VIDAR Stealer
Vidar
2022-12-08 ⋅ Youtube (AhmedS Kasmani) ⋅ AhmedS Kasmani
Vidar Stealer Malware Analysis
Vidar
2022-11-19 ⋅ Malwarology ⋅ Robert Simmons
Malicious Packer pkr_ce1a
SmokeLoader Vidar
2022-11-15 ⋅ SOC Prime ⋅ Veronika Telychko
Somnia Malware Detection: UAC-0118 aka FRwL Launches Cyber Attacks Against Organizations in Ukraine Using Enhanced Malware Strains
Cobalt Strike Vidar UAC-0118
2022-11-08 ⋅ cyble ⋅ Cyble
Massive YouTube Campaign Targeting Over 100 Applications To Deliver Info Stealer
RecordBreaker Vidar
2022-10-03 ⋅ Check Point ⋅ Marc Salinas Fernandez
Bumblebee: increasing its capacity and evolving its TTPs
BumbleBee Cobalt Strike Meterpreter Sliver Vidar
2022-09-26 ⋅ Kaspersky ⋅ Artem Ushkov, Haim Zigel, Oleg Kupreev
NullMixer: oodles of Trojans in a single dropper
ColdStealer DanaBot GCleaner Nullmixer PrivateLoader PseudoManuscrypt RedLine Stealer SmokeLoader Vidar
2022-09-16 ⋅ Group-IB ⋅ Twitter (@GroupIB_GIB)
Tweet on Uber Employees potentially infected with Raccoon and Vidar stealer
Raccoon Vidar
2022-09-15 ⋅ Sekoia ⋅ Threat & Detection Research Team
PrivateLoader: the loader of the prevalent ruzki PPI service
Agent Tesla Coinminer DanaBot DCRat Eternity Stealer Glupteba Mars Stealer NetSupportManager RAT Nymaim Nymaim2 Phoenix Keylogger PrivateLoader Raccoon RedLine Stealer SmokeLoader Socelars STOP Vidar YTStealer
2022-08-29 ⋅ Sekoia ⋅ Livia Tibirna, Quentin Bourgue, Threat & Detection Research Team
Traffers: a deep dive into the information stealer ecosystem
MetaStealer PrivateLoader Raccoon RedLine Stealer Vidar
2022-08-08 ⋅ Medium CSIS Techblog ⋅ Benoît Ancel
An inside view of domain anonymization as-a-service — the BraZZZerSFF infrastructure
Riltok magecart Anubis Azorult BetaBot Buer CoalaBot CryptBot DiamondFox DreamBot GCleaner ISFB Loki Password Stealer (PWS) MedusaLocker MeguminTrojan Nemty PsiX RedLine Stealer SmokeLoader STOP TinyNuke Vidar Zloader
2022-08-02 ⋅ Recorded Future ⋅ Insikt Group
Initial Access Brokers Are Key to Rise in Ransomware Attacks
Azorult BlackMatter Conti Mars Stealer Raccoon RedLine Stealer Taurus Stealer Vidar
2022-07-13 ⋅ KELA ⋅ KELA Cyber Intelligence Center
The Next Generation of Info Stealers
Arkei Stealer Azorult BlackGuard Eternity Stealer Ginzo Stealer Mars Stealer MetaStealer Raccoon RedLine Stealer Vidar
2022-05-19 ⋅ Zscaler ⋅ Brett Stone-Gross, Santiago Vicente, Sudeep Singh
Vidar distributed through backdoored Windows 11 downloads and abusing Telegram
Vidar
2022-05-18 ⋅ Github (0x00-0x7f) ⋅ Sadia Bashir
A Case of Vidar Infostealer - Part 2
Vidar
2022-05-15 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Fake Pixelmon NFT site infects you with password-stealing malware
Vidar
2022-03-27 ⋅ Github (0x00-0x7f) ⋅ Sadia Bashir
A Case of Vidar Infostealer - Part 1 (Unpacking)
Vidar
2022-03-24 ⋅ Trustwave ⋅ Diana Lopera
Vidar Malware Launcher Concealed in Help File
Vidar
2022-03-24 ⋅ Threat Post ⋅ Nate Nelson
Microsoft Help Files Disguise Vidar Malware
Vidar
2022-03-24 ⋅ CSO Online ⋅ Jon Gold
Microsoft help files repurposed to contain Vidar malware in new campaign
Vidar
2022-03-23 ⋅ InfoSec Handlers Diary Blog ⋅ Brad Duncan
Arkei Variants: From Vidar to Mars Stealer
Arkei Stealer Mars Stealer Oski Stealer Vidar
2022-03-23 ⋅ InfoSec Handlers Diary Blog ⋅ Brad Duncan
Arkei Variants: From Vidar to Mars Stealer
Arkei Stealer Mars Stealer Vidar
2022-02-08 ⋅ Intel 471 ⋅ Intel 471
PrivateLoader: The first step in many malware schemes
Dridex Kronos LockBit Nanocore RAT NjRAT PrivateLoader Quasar RAT RedLine Stealer Remcos SmokeLoader STOP Tofsee TrickBot Vidar
2022-02-06 ⋅ Github (eln0ty) ⋅ Abdallah Elnoty
Deep Analysis of Vidar Information Stealer
Vidar
2022-01-26 ⋅ AhnLab ⋅ ASEC Analysis Team
Vidar Exploiting Social Media Platform (Mastodon)
Vidar
2022-01-03 ⋅ AhnLab ⋅ ASEC Analysis Team
Distribution of Redline Stealer Disguised as Software Crack
DanaBot RedLine Stealer Vidar
2021-10-27 ⋅ CERT.PL ⋅ CERT.PL
Vidar stealer campaign targeting Baltic region and NATO entities
Vidar
2021-09-27 ⋅ Trend Micro ⋅ Arianne Dela Cruz, Gilbert Sison, Joelson Soares, Ryan Maglaque, Warren Sto.Tomas
Fake Installers Drop Malware and Open Doors for Opportunistic Attackers
RedLine Stealer Socelars Vidar
2021-09-23 ⋅ Minerva Labs ⋅ Minerva Labs
Vidar Stealer Evasion Arsenal
Vidar
2021-08-04 ⋅ ⋅ ASEC ⋅ ASEC
S/W Download Camouflage, Spreading Various Kinds of Malware
Raccoon RedLine Stealer Remcos Vidar
2021-07-16 ⋅ Malwarebytes Labs ⋅ Jérôme Segura
Vidar and GandCrab: stealer and ransomware combo observed in the wild
Gandcrab Vidar
2021-07-15 ⋅ Twitter (@hypen1117) ⋅ Hypen
Vidar Stealer C&C Server List
Vidar
2021-06-29 ⋅ Twitter (@sisoma2) ⋅ sisoma2
Tweet on vidar stealer using Tumblr to obtain dynamic config
Vidar
2021-05-28 ⋅ Medium s2wlab ⋅ Sojun Ryu
Deep Analysis of Vidar Stealer
Vidar
2021-05-24 ⋅ AhnLab ⋅ ASEC Analysis Team
Vidar Info-Stealer Abusing Game Platform
Vidar
2021-02-03 ⋅ Medium s2wlab ⋅ Hyunmin Suh, Minjei Cho
W1 Feb| EN | Story of the week: Stealers on the Darkweb
Azorult Raccoon Vidar
2020-03-04 ⋅ CrowdStrike ⋅ CrowdStrike
2020 CrowdStrike Global Threat Report
MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelDridex DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze MECHANICAL Necurs Nokki Outlook Backdoor Phobos Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot Vidar Winnti ANTHROPOID SPIDER APT23 APT31 APT39 APT40 BlackTech BuhTrap Charming Kitten CLOCKWORK SPIDER DOPPEL SPIDER FIN7 Gamaredon Group GOBLIN PANDA MONTY SPIDER MUSTANG PANDA NARWHAL SPIDER NOCTURNAL SPIDER PINCHY SPIDER SALTY SPIDER SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER VICEROY TIGER
2020-02-05 ⋅ Cybereason ⋅ Assaf Dahan, Lior Rochberger
The Hole in the Bucket: Attackers Abuse Bitbucket to Deliver an Arsenal of Malware
Amadey Azorult Predator The Thief STOP Vidar
2019-03-11 ⋅ tcontre
Infor Stealer Vidar TrojanSpy Analysis...
Vidar
2019-01-07 ⋅ Bleeping Computer ⋅ Ionut Ilascu
GandCrab Operators Use Vidar Infostealer as a Forerunner
Gandcrab Vidar
2018-12-24 ⋅ fumik0 blog ⋅ fumik0
Let’s dig into Vidar – An Arkei Copycat/Forked Stealer (In-depth analysis)
Arkei Stealer Vidar
Yara Rules
[TLP:WHITE] win_vidar_auto (20241030 | Detects win.vidar.)
rule win_vidar_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2024-10-31"
        version = "1"
        description = "Detects win.vidar."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar"
        malpedia_rule_date = "20241030"
        malpedia_hash = "26e26953c49c8efafbf72a38076855d578e0a2e4"
        malpedia_version = "20241030"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 05c39e2600 894114 c1e810 25ff7f0000 c3 e8???????? 8b486c }
            // n = 7, score = 2600
            //   05c39e2600           | add                 eax, 0x269ec3
            //   894114               | mov                 dword ptr [ecx + 0x14], eax
            //   c1e810               | shr                 eax, 0x10
            //   25ff7f0000           | and                 eax, 0x7fff
            //   c3                   | ret                 
            //   e8????????           |                     
            //   8b486c               | mov                 ecx, dword ptr [eax + 0x6c]

        $sequence_1 = { 7202 8b00 8d8d68fdffff 51 50 }
            // n = 5, score = 2500
            //   7202                 | jb                  4
            //   8b00                 | mov                 eax, dword ptr [eax]
            //   8d8d68fdffff         | lea                 ecx, [ebp - 0x298]
            //   51                   | push                ecx
            //   50                   | push                eax

        $sequence_2 = { 8b7508 33db 895dd0 c746140f000000 895e10 8975cc }
            // n = 6, score = 2400
            //   8b7508               | mov                 esi, dword ptr [ebp + 8]
            //   33db                 | xor                 ebx, ebx
            //   895dd0               | mov                 dword ptr [ebp - 0x30], ebx
            //   c746140f000000       | mov                 dword ptr [esi + 0x14], 0xf
            //   895e10               | mov                 dword ptr [esi + 0x10], ebx
            //   8975cc               | mov                 dword ptr [ebp - 0x34], esi

        $sequence_3 = { 8b8648af0100 c1e803 038644af0100 5e 5d c3 }
            // n = 6, score = 2400
            //   8b8648af0100         | mov                 eax, dword ptr [esi + 0x1af48]
            //   c1e803               | shr                 eax, 3
            //   038644af0100         | add                 eax, dword ptr [esi + 0x1af44]
            //   5e                   | pop                 esi
            //   5d                   | pop                 ebp
            //   c3                   | ret                 

        $sequence_4 = { 5f c6043300 8bc6 5e 5b c20400 }
            // n = 6, score = 2400
            //   5f                   | pop                 edi
            //   c6043300             | mov                 byte ptr [ebx + esi], 0
            //   8bc6                 | mov                 eax, esi
            //   5e                   | pop                 esi
            //   5b                   | pop                 ebx
            //   c20400               | ret                 4

        $sequence_5 = { 89b55cfdffff 89bd60fdffff 8d450c 50 }
            // n = 4, score = 2400
            //   89b55cfdffff         | mov                 dword ptr [ebp - 0x2a4], esi
            //   89bd60fdffff         | mov                 dword ptr [ebp - 0x2a0], edi
            //   8d450c               | lea                 eax, [ebp + 0xc]
            //   50                   | push                eax

        $sequence_6 = { d9e0 d99d00ffffff d98500ffffff d91c24 }
            // n = 4, score = 2400
            //   d9e0                 | fchs                
            //   d99d00ffffff         | fstp                dword ptr [ebp - 0x100]
            //   d98500ffffff         | fld                 dword ptr [ebp - 0x100]
            //   d91c24               | fstp                dword ptr [esp]

        $sequence_7 = { 740a b800000500 e9???????? 57 }
            // n = 4, score = 2400
            //   740a                 | je                  0xc
            //   b800000500           | mov                 eax, 0x50000
            //   e9????????           |                     
            //   57                   | push                edi

        $sequence_8 = { 895dfc e8???????? 83781408 c645fc01 }
            // n = 4, score = 2400
            //   895dfc               | mov                 dword ptr [ebp - 4], ebx
            //   e8????????           |                     
            //   83781408             | cmp                 dword ptr [eax + 0x14], 8
            //   c645fc01             | mov                 byte ptr [ebp - 4], 1

        $sequence_9 = { 8b7508 33ff 89b55cfdffff 89bd60fdffff }
            // n = 4, score = 2400
            //   8b7508               | mov                 esi, dword ptr [ebp + 8]
            //   33ff                 | xor                 edi, edi
            //   89b55cfdffff         | mov                 dword ptr [ebp - 0x2a4], esi
            //   89bd60fdffff         | mov                 dword ptr [ebp - 0x2a0], edi

        $sequence_10 = { 56 8b742408 8b865caf0100 57 }
            // n = 4, score = 2400
            //   56                   | push                esi
            //   8b742408             | mov                 esi, dword ptr [esp + 8]
            //   8b865caf0100         | mov                 eax, dword ptr [esi + 0x1af5c]
            //   57                   | push                edi

        $sequence_11 = { 5e c20400 ff742408 e8???????? 59 83f8ff 7503 }
            // n = 7, score = 2300
            //   5e                   | pop                 esi
            //   c20400               | ret                 4
            //   ff742408             | push                dword ptr [esp + 8]
            //   e8????????           |                     
            //   59                   | pop                 ecx
            //   83f8ff               | cmp                 eax, -1
            //   7503                 | jne                 5

        $sequence_12 = { c9 c3 8b542408 85d2 7503 33c0 c3 }
            // n = 7, score = 2300
            //   c9                   | leave               
            //   c3                   | ret                 
            //   8b542408             | mov                 edx, dword ptr [esp + 8]
            //   85d2                 | test                edx, edx
            //   7503                 | jne                 5
            //   33c0                 | xor                 eax, eax
            //   c3                   | ret                 

        $sequence_13 = { 83781410 7202 8b00 50 8b45a0 }
            // n = 5, score = 2300
            //   83781410             | cmp                 dword ptr [eax + 0x14], 0x10
            //   7202                 | jb                  4
            //   8b00                 | mov                 eax, dword ptr [eax]
            //   50                   | push                eax
            //   8b45a0               | mov                 eax, dword ptr [ebp - 0x60]

        $sequence_14 = { 50 ff15???????? 8b4da0 8901 }
            // n = 4, score = 2300
            //   50                   | push                eax
            //   ff15????????         |                     
            //   8b4da0               | mov                 ecx, dword ptr [ebp - 0x60]
            //   8901                 | mov                 dword ptr [ecx], eax

        $sequence_15 = { 53 68???????? 6802000080 ff15???????? 85c0 751b }
            // n = 6, score = 2300
            //   53                   | push                ebx
            //   68????????           |                     
            //   6802000080           | push                0x80000002
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax
            //   751b                 | jne                 0x1d

        $sequence_16 = { c1e004 8bf0 0fbe4301 50 }
            // n = 4, score = 2300
            //   c1e004               | shl                 eax, 4
            //   8bf0                 | mov                 esi, eax
            //   0fbe4301             | movsx               eax, byte ptr [ebx + 1]
            //   50                   | push                eax

        $sequence_17 = { 68???????? e8???????? 59 83f820 }
            // n = 4, score = 2200
            //   68????????           |                     
            //   e8????????           |                     
            //   59                   | pop                 ecx
            //   83f820               | cmp                 eax, 0x20

        $sequence_18 = { 50 6a09 53 68???????? }
            // n = 4, score = 2200
            //   50                   | push                eax
            //   6a09                 | push                9
            //   53                   | push                ebx
            //   68????????           |                     

        $sequence_19 = { 50 0fb605???????? 50 6a01 }
            // n = 4, score = 2200
            //   50                   | push                eax
            //   0fb605????????       |                     
            //   50                   | push                eax
            //   6a01                 | push                1

        $sequence_20 = { 399e70af0600 7514 c78678af060001000000 c78670af060000000100 68fcff0100 8d8670af0400 }
            // n = 6, score = 2100
            //   399e70af0600         | cmp                 dword ptr [esi + 0x6af70], ebx
            //   7514                 | jne                 0x16
            //   c78678af060001000000     | mov    dword ptr [esi + 0x6af78], 1
            //   c78670af060000000100     | mov    dword ptr [esi + 0x6af70], 0x10000
            //   68fcff0100           | push                0x1fffc
            //   8d8670af0400         | lea                 eax, [esi + 0x4af70]

        $sequence_21 = { 53 50 899e6caf0600 e8???????? }
            // n = 4, score = 2100
            //   53                   | push                ebx
            //   50                   | push                eax
            //   899e6caf0600         | mov                 dword ptr [esi + 0x6af6c], ebx
            //   e8????????           |                     

        $sequence_22 = { 895df0 8d45f0 50 6a09 }
            // n = 4, score = 2100
            //   895df0               | mov                 dword ptr [ebp - 0x10], ebx
            //   8d45f0               | lea                 eax, [ebp - 0x10]
            //   50                   | push                eax
            //   6a09                 | push                9

        $sequence_23 = { 0fbe4301 50 8bc1 50 }
            // n = 4, score = 2100
            //   0fbe4301             | movsx               eax, byte ptr [ebx + 1]
            //   50                   | push                eax
            //   8bc1                 | mov                 eax, ecx
            //   50                   | push                eax

        $sequence_24 = { 53 68???????? 8d8da8000000 e8???????? }
            // n = 4, score = 2100
            //   53                   | push                ebx
            //   68????????           |                     
            //   8d8da8000000         | lea                 ecx, [ebp + 0xa8]
            //   e8????????           |                     

        $sequence_25 = { 741d ff75f0 ff15???????? 895df0 395df0 740c }
            // n = 6, score = 2100
            //   741d                 | je                  0x1f
            //   ff75f0               | push                dword ptr [ebp - 0x10]
            //   ff15????????         |                     
            //   895df0               | mov                 dword ptr [ebp - 0x10], ebx
            //   395df0               | cmp                 dword ptr [ebp - 0x10], ebx
            //   740c                 | je                  0xe

        $sequence_26 = { 68fcff0100 8d8670af0400 53 50 }
            // n = 4, score = 2100
            //   68fcff0100           | push                0x1fffc
            //   8d8670af0400         | lea                 eax, [esi + 0x4af70]
            //   53                   | push                ebx
            //   50                   | push                eax

        $sequence_27 = { c3 55 8bec 83ec0c 8365fc00 8365f400 8365f800 }
            // n = 7, score = 1900
            //   c3                   | ret                 
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   83ec0c               | sub                 esp, 0xc
            //   8365fc00             | and                 dword ptr [ebp - 4], 0
            //   8365f400             | and                 dword ptr [ebp - 0xc], 0
            //   8365f800             | and                 dword ptr [ebp - 8], 0

        $sequence_28 = { 8910 8b4120 8910 8b4130 8910 c3 56 }
            // n = 7, score = 1800
            //   8910                 | mov                 dword ptr [eax], edx
            //   8b4120               | mov                 eax, dword ptr [ecx + 0x20]
            //   8910                 | mov                 dword ptr [eax], edx
            //   8b4130               | mov                 eax, dword ptr [ecx + 0x30]
            //   8910                 | mov                 dword ptr [eax], edx
            //   c3                   | ret                 
            //   56                   | push                esi

        $sequence_29 = { 8d852cffffff 50 8d459c 50 }
            // n = 4, score = 1800
            //   8d852cffffff         | lea                 eax, [ebp - 0xd4]
            //   50                   | push                eax
            //   8d459c               | lea                 eax, [ebp - 0x64]
            //   50                   | push                eax

        $sequence_30 = { c20400 56 8bf1 e8???????? 6a00 ff74240c 8bce }
            // n = 7, score = 1800
            //   c20400               | ret                 4
            //   56                   | push                esi
            //   8bf1                 | mov                 esi, ecx
            //   e8????????           |                     
            //   6a00                 | push                0
            //   ff74240c             | push                dword ptr [esp + 0xc]
            //   8bce                 | mov                 ecx, esi

        $sequence_31 = { 0faf450c 50 e8???????? 59 }
            // n = 4, score = 1800
            //   0faf450c             | imul                eax, dword ptr [ebp + 0xc]
            //   50                   | push                eax
            //   e8????????           |                     
            //   59                   | pop                 ecx

        $sequence_32 = { 8b4508 8906 8b450c 894608 8b4510 }
            // n = 5, score = 1800
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8906                 | mov                 dword ptr [esi], eax
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   894608               | mov                 dword ptr [esi + 8], eax
            //   8b4510               | mov                 eax, dword ptr [ebp + 0x10]

        $sequence_33 = { e8???????? c9 c3 55 8bec 83ec18 8b450c }
            // n = 7, score = 1800
            //   e8????????           |                     
            //   c9                   | leave               
            //   c3                   | ret                 
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   83ec18               | sub                 esp, 0x18
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]

        $sequence_34 = { 50 ff15???????? 6a1a e8???????? }
            // n = 4, score = 800
            //   50                   | push                eax
            //   ff15????????         |                     
            //   6a1a                 | push                0x1a
            //   e8????????           |                     

        $sequence_35 = { 6860ea0000 6a00 ff15???????? 50 ff15???????? }
            // n = 5, score = 800
            //   6860ea0000           | push                0xea60
            //   6a00                 | push                0
            //   ff15????????         |                     
            //   50                   | push                eax
            //   ff15????????         |                     

        $sequence_36 = { ff15???????? 59 59 50 6a06 }
            // n = 5, score = 700
            //   ff15????????         |                     
            //   59                   | pop                 ecx
            //   59                   | pop                 ecx
            //   50                   | push                eax
            //   6a06                 | push                6

        $sequence_37 = { 5f c21000 8bff 55 8bec 6a0a 6a00 }
            // n = 7, score = 700
            //   5f                   | pop                 edi
            //   c21000               | ret                 0x10
            //   8bff                 | mov                 edi, edi
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   6a0a                 | push                0xa
            //   6a00                 | push                0

        $sequence_38 = { e8???????? 83c410 85c0 7404 6a99 ebcc }
            // n = 6, score = 600
            //   e8????????           |                     
            //   83c410               | add                 esp, 0x10
            //   85c0                 | test                eax, eax
            //   7404                 | je                  6
            //   6a99                 | push                -0x67
            //   ebcc                 | jmp                 0xffffffce

        $sequence_39 = { 83e03f 03d2 897110 894104 8911 5e c3 }
            // n = 7, score = 500
            //   83e03f               | and                 eax, 0x3f
            //   03d2                 | add                 edx, edx
            //   897110               | mov                 dword ptr [ecx + 0x10], esi
            //   894104               | mov                 dword ptr [ecx + 4], eax
            //   8911                 | mov                 dword ptr [ecx], edx
            //   5e                   | pop                 esi
            //   c3                   | ret                 

        $sequence_40 = { 80780800 7404 33c0 40 c3 33c0 }
            // n = 6, score = 500
            //   80780800             | cmp                 byte ptr [eax + 8], 0
            //   7404                 | je                  6
            //   33c0                 | xor                 eax, eax
            //   40                   | inc                 eax
            //   c3                   | ret                 
            //   33c0                 | xor                 eax, eax

        $sequence_41 = { dd1c24 83ec08 dd4508 dd1c24 6a0b 6a10 e8???????? }
            // n = 7, score = 200
            //   dd1c24               | fstp                qword ptr [esp]
            //   83ec08               | sub                 esp, 8
            //   dd4508               | fld                 qword ptr [ebp + 8]
            //   dd1c24               | fstp                qword ptr [esp]
            //   6a0b                 | push                0xb
            //   6a10                 | push                0x10
            //   e8????????           |                     

        $sequence_42 = { dd4508 dd1c24 6a0b 6a08 e8???????? 83c41c }
            // n = 6, score = 200
            //   dd4508               | fld                 qword ptr [ebp + 8]
            //   dd1c24               | fstp                qword ptr [esp]
            //   6a0b                 | push                0xb
            //   6a08                 | push                8
            //   e8????????           |                     
            //   83c41c               | add                 esp, 0x1c

        $sequence_43 = { eb0b 8b45f4 0500040000 8945f4 }
            // n = 4, score = 200
            //   eb0b                 | jmp                 0xd
            //   8b45f4               | mov                 eax, dword ptr [ebp - 0xc]
            //   0500040000           | add                 eax, 0x400
            //   8945f4               | mov                 dword ptr [ebp - 0xc], eax

        $sequence_44 = { 8bc6 5e c3 56 8bf1 6a08 }
            // n = 6, score = 100
            //   8bc6                 | mov                 eax, esi
            //   5e                   | pop                 esi
            //   c3                   | ret                 
            //   56                   | push                esi
            //   8bf1                 | mov                 esi, ecx
            //   6a08                 | push                8

        $sequence_45 = { 8bc6 5e c20800 8b3f 85ff 7426 }
            // n = 6, score = 100
            //   8bc6                 | mov                 eax, esi
            //   5e                   | pop                 esi
            //   c20800               | ret                 8
            //   8b3f                 | mov                 edi, dword ptr [edi]
            //   85ff                 | test                edi, edi
            //   7426                 | je                  0x28

        $sequence_46 = { 8bc6 5e c3 8b0a 80790d00 750c }
            // n = 6, score = 100
            //   8bc6                 | mov                 eax, esi
            //   5e                   | pop                 esi
            //   c3                   | ret                 
            //   8b0a                 | mov                 ecx, dword ptr [edx]
            //   80790d00             | cmp                 byte ptr [ecx + 0xd], 0
            //   750c                 | jne                 0xe

    condition:
        7 of them and filesize < 4751360
}
[TLP:WHITE] win_vidar_w0   (20190106 | Yara rule for detecting Vidar stealer)
rule win_vidar_w0 {
    meta:
        description = "Yara rule for detecting Vidar stealer"
        author = "Fumik0_"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar"
        malpedia_version = "20190106"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $s1 = { 56 69 64 61 72 }
        $s2 = { 31 42 45 46 30 41 35 37 42 45 31 31 30 46 44 34 36 37 41 }
        
    condition:
        all of them
}
Download all Yara Rules