SYMBOLCOMMON_NAMEaka. SYNONYMS
win.vidar (Back to overview)

Vidar


Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.

References
2022-05-19ZscalerSudeep Singh, Santiago Vicente, Brett Stone-Gross
@online{singh:20220519:vidar:1c68f0e, author = {Sudeep Singh and Santiago Vicente and Brett Stone-Gross}, title = {{Vidar distributed through backdoored Windows 11 downloads and abusing Telegram}}, date = {2022-05-19}, organization = {Zscaler}, url = {https://www.zscaler.com/blogs/security-research/vidar-distributed-through-backdoored-windows-11-downloads-and-abusing}, language = {English}, urldate = {2022-05-25} } Vidar distributed through backdoored Windows 11 downloads and abusing Telegram
Vidar
2022-05-18Github (0x00-0x7f)Sadia Bashir
@online{bashir:20220518:case:986df17, author = {Sadia Bashir}, title = {{A Case of Vidar Infostealer - Part 2}}, date = {2022-05-18}, organization = {Github (0x00-0x7f)}, url = {https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/}, language = {English}, urldate = {2022-05-25} } A Case of Vidar Infostealer - Part 2
Vidar
2022-05-15Bleeping ComputerLawrence Abrams
@online{abrams:20220515:fake:13bfa09, author = {Lawrence Abrams}, title = {{Fake Pixelmon NFT site infects you with password-stealing malware}}, date = {2022-05-15}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/fake-pixelmon-nft-site-infects-you-with-password-stealing-malware/}, language = {English}, urldate = {2022-05-17} } Fake Pixelmon NFT site infects you with password-stealing malware
Vidar
2022-03-27Github (0x00-0x7f)Sadia Bashir
@online{bashir:20220327:case:80e7471, author = {Sadia Bashir}, title = {{A Case of Vidar Infostealer - Part 1 (Unpacking)}}, date = {2022-03-27}, organization = {Github (0x00-0x7f)}, url = {https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/}, language = {English}, urldate = {2022-03-31} } A Case of Vidar Infostealer - Part 1 (Unpacking)
Vidar
2022-03-24CSO OnlineJon Gold
@online{gold:20220324:microsoft:1a7616f, author = {Jon Gold}, title = {{Microsoft help files repurposed to contain Vidar malware in new campaign}}, date = {2022-03-24}, organization = {CSO Online}, url = {https://www.csoonline.com/article/3654849/microsoft-help-files-repurposed-to-contain-vidar-malware-in-new-campaign.html}, language = {English}, urldate = {2022-03-25} } Microsoft help files repurposed to contain Vidar malware in new campaign
Vidar
2022-03-24TrustwaveDiana Lopera
@online{lopera:20220324:vidar:ec04874, author = {Diana Lopera}, title = {{Vidar Malware Launcher Concealed in Help File}}, date = {2022-03-24}, organization = {Trustwave}, url = {https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/vidar-malware-launcher-concealed-in-help-file/}, language = {English}, urldate = {2022-03-25} } Vidar Malware Launcher Concealed in Help File
Vidar
2022-03-24Threat PostNate Nelson
@online{nelson:20220324:microsoft:027f9d7, author = {Nate Nelson}, title = {{Microsoft Help Files Disguise Vidar Malware}}, date = {2022-03-24}, organization = {Threat Post}, url = {https://threatpost.com/microsoft-help-files-vidar-malware/179078/}, language = {English}, urldate = {2022-03-25} } Microsoft Help Files Disguise Vidar Malware
Vidar
2022-03-23InfoSec Handlers Diary BlogBrad Duncan
@online{duncan:20220323:arkei:b2a08f5, author = {Brad Duncan}, title = {{Arkei Variants: From Vidar to Mars Stealer}}, date = {2022-03-23}, organization = {InfoSec Handlers Diary Blog}, url = {https://isc.sans.edu/diary/rss/28468}, language = {English}, urldate = {2022-03-25} } Arkei Variants: From Vidar to Mars Stealer
Arkei Stealer Mars Stealer Vidar
2022-02-08Intel 471Intel 471
@online{471:20220208:privateloader:5e226cd, author = {Intel 471}, title = {{PrivateLoader: The first step in many malware schemes}}, date = {2022-02-08}, organization = {Intel 471}, url = {https://intel471.com/blog/privateloader-malware}, language = {English}, urldate = {2022-05-09} } PrivateLoader: The first step in many malware schemes
Dridex Kronos LockBit Nanocore RAT NjRAT PrivateLoader Quasar RAT RedLine Stealer Remcos SmokeLoader STOP Tofsee TrickBot Vidar
2022-02-06Github (eln0ty)Abdallah Elnoty
@online{elnoty:20220206:deep:d85c241, author = {Abdallah Elnoty}, title = {{Deep Analysis of Vidar Information Stealer}}, date = {2022-02-06}, organization = {Github (eln0ty)}, url = {https://eln0ty.github.io/malware%20analysis/vidar/}, language = {English}, urldate = {2022-02-17} } Deep Analysis of Vidar Information Stealer
Vidar
2022-01-26AhnLabASEC Analysis Team
@online{team:20220126:vidar:3bf84d2, author = {ASEC Analysis Team}, title = {{Vidar Exploiting Social Media Platform (Mastodon)}}, date = {2022-01-26}, organization = {AhnLab}, url = {https://asec.ahnlab.com/en/30875/}, language = {English}, urldate = {2022-02-01} } Vidar Exploiting Social Media Platform (Mastodon)
Vidar
2022-01-03AhnLabASEC Analysis Team
@online{team:20220103:distribution:6b19c5a, author = {ASEC Analysis Team}, title = {{Distribution of Redline Stealer Disguised as Software Crack}}, date = {2022-01-03}, organization = {AhnLab}, url = {https://asec.ahnlab.com/en/30445/}, language = {English}, urldate = {2022-01-25} } Distribution of Redline Stealer Disguised as Software Crack
DanaBot RedLine Stealer Vidar
2021-10-27CERT.PLCERT.PL
@online{certpl:20211027:vidar:8fe3984, author = {CERT.PL}, title = {{Vidar stealer campaign targeting Baltic region and NATO entities}}, date = {2021-10-27}, organization = {CERT.PL}, url = {https://cert.pl/en/posts/2021/10/vidar-campaign/}, language = {English}, urldate = {2021-11-02} } Vidar stealer campaign targeting Baltic region and NATO entities
Vidar
2021-09-27Trend MicroRyan Maglaque, Joelson Soares, Gilbert Sison, Arianne Dela Cruz, Warren Sto.Tomas
@online{maglaque:20210927:fake:e02e3a3, author = {Ryan Maglaque and Joelson Soares and Gilbert Sison and Arianne Dela Cruz and Warren Sto.Tomas}, title = {{Fake Installers Drop Malware and Open Doors for Opportunistic Attackers}}, date = {2021-09-27}, organization = {Trend Micro}, url = {https://www.trendmicro.com/en_us/research/21/i/fake-installers-drop-malware-and-open-doors-for-opportunistic-attackers.html}, language = {English}, urldate = {2021-10-05} } Fake Installers Drop Malware and Open Doors for Opportunistic Attackers
RedLine Stealer Socelars Vidar
2021-09-23Minerva LabsMinerva Labs
@online{labs:20210923:vidar:36d9ecf, author = {Minerva Labs}, title = {{Vidar Stealer Evasion Arsenal}}, date = {2021-09-23}, organization = {Minerva Labs}, url = {https://blog.minerva-labs.com/vidar-stealer-evasion-arsenal}, language = {English}, urldate = {2021-10-05} } Vidar Stealer Evasion Arsenal
Vidar
2021-08-04ASECASEC
@online{asec:20210804:sw:fd538d1, author = {ASEC}, title = {{S/W Download Camouflage, Spreading Various Kinds of Malware}}, date = {2021-08-04}, organization = {ASEC}, url = {https://asec.ahnlab.com/ko/25837/}, language = {Korean}, urldate = {2022-03-07} } S/W Download Camouflage, Spreading Various Kinds of Malware
Raccoon RedLine Stealer Remcos Vidar
2021-07-16Malwarebytes LabsJérôme Segura
@online{segura:20210716:vidar:372aace, author = {Jérôme Segura}, title = {{Vidar and GandCrab: stealer and ransomware combo observed in the wild}}, date = {2021-07-16}, organization = {Malwarebytes Labs}, url = {https://blog.malwarebytes.com/threat-analysis/2019/01/vidar-gandcrab-stealer-and-ransomware-combo-observed-in-the-wild/}, language = {English}, urldate = {2022-04-12} } Vidar and GandCrab: stealer and ransomware combo observed in the wild
Gandcrab Vidar
2021-07-15Twitter (@hypen1117)Hypen
@online{hypen:20210715:vidar:a1d1821, author = {Hypen}, title = {{Vidar Stealer C&C Server List}}, date = {2021-07-15}, organization = {Twitter (@hypen1117)}, url = {https://docs.google.com/spreadsheets/d/1nx42rdMdkCrvlmACDi3CHseyG87iSV1Y6rGZYq_-oDk}, language = {English}, urldate = {2021-07-20} } Vidar Stealer C&C Server List
Vidar
2021-06-29Twitter (@sisoma2)sisoma2
@online{sisoma2:20210629:vidar:b63dd63, author = {sisoma2}, title = {{Tweet on vidar stealer using Tumblr to obtain dynamic config}}, date = {2021-06-29}, organization = {Twitter (@sisoma2)}, url = {https://twitter.com/sisoma2/status/1409816282065743872}, language = {English}, urldate = {2021-07-02} } Tweet on vidar stealer using Tumblr to obtain dynamic config
Vidar
2021-05-28Medium s2wlabSojun Ryu
@online{ryu:20210528:deep:c5d221c, author = {Sojun Ryu}, title = {{Deep Analysis of Vidar Stealer}}, date = {2021-05-28}, organization = {Medium s2wlab}, url = {https://medium.com/s2wlab/deep-analysis-of-vidar-stealer-ebfc3b557aed}, language = {English}, urldate = {2021-06-16} } Deep Analysis of Vidar Stealer
Vidar
2021-05-24AhnLabASEC Analysis Team
@online{team:20210524:vidar:ea3dec5, author = {ASEC Analysis Team}, title = {{Vidar Info-Stealer Abusing Game Platform}}, date = {2021-05-24}, organization = {AhnLab}, url = {https://asec.ahnlab.com/en/22932/}, language = {English}, urldate = {2022-04-15} } Vidar Info-Stealer Abusing Game Platform
Vidar
2021-02-03Medium s2wlabHyunmin Suh, Minjei Cho
@online{suh:20210203:w1:45a76f4, author = {Hyunmin Suh and Minjei Cho}, title = {{W1 Feb| EN | Story of the week: Stealers on the Darkweb}}, date = {2021-02-03}, organization = {Medium s2wlab}, url = {https://medium.com/s2wlab/w1-feb-en-story-of-the-week-stealers-on-the-darkweb-49945a31601d}, language = {English}, urldate = {2021-02-04} } W1 Feb| EN | Story of the week: Stealers on the Darkweb
Azorult Raccoon Vidar
2020-03-04CrowdStrikeCrowdStrike
@techreport{crowdstrike:20200304:2020:818c85f, author = {CrowdStrike}, title = {{2020 CrowdStrike Global Threat Report}}, date = {2020-03-04}, institution = {CrowdStrike}, url = {https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf}, language = {English}, urldate = {2020-07-24} } 2020 CrowdStrike Global Threat Report
MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelDridex DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze MECHANICAL Necurs Nokki Outlook Backdoor Phobos Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot Vidar Winnti ANTHROPOID SPIDER APT31 APT39 BlackTech BuhTrap Charming Kitten CLOCKWORK SPIDER DOPPEL SPIDER FIN7 Gamaredon Group Leviathan MONTY SPIDER Mustang Panda NARWHAL SPIDER NOCTURNAL SPIDER PINCHY SPIDER Pirate Panda SALTY SPIDER SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER VICEROY TIGER
2020-02-05CybereasonLior Rochberger, Assaf Dahan
@online{rochberger:20200205:hole:b982e31, author = {Lior Rochberger and Assaf Dahan}, title = {{The Hole in the Bucket: Attackers Abuse Bitbucket to Deliver an Arsenal of Malware}}, date = {2020-02-05}, organization = {Cybereason}, url = {https://www.cybereason.com/blog/the-hole-in-the-bucket-attackers-abuse-bitbucket-to-deliver-an-arsenal-of-malware}, language = {English}, urldate = {2020-02-09} } The Hole in the Bucket: Attackers Abuse Bitbucket to Deliver an Arsenal of Malware
Amadey Azorult Predator The Thief STOP Vidar
2019-03-11tcontre
@online{tcontre:20190311:infor:d8863ed, author = {tcontre}, title = {{Infor Stealer Vidar TrojanSpy Analysis...}}, date = {2019-03-11}, url = {https://tccontre.blogspot.com/2019/03/infor-stealer-vidar-trojanspy-analysis.html}, language = {English}, urldate = {2020-01-05} } Infor Stealer Vidar TrojanSpy Analysis...
Vidar
2019-01-07Bleeping ComputerIonut Ilascu
@online{ilascu:20190107:gandcrab:8167b7f, author = {Ionut Ilascu}, title = {{GandCrab Operators Use Vidar Infostealer as a Forerunner}}, date = {2019-01-07}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/gandcrab-operators-use-vidar-infostealer-as-a-forerunner/}, language = {English}, urldate = {2019-12-20} } GandCrab Operators Use Vidar Infostealer as a Forerunner
Gandcrab Vidar
2018-12-24fumik0 blogfumik0
@online{fumik0:20181224:lets:f7dfc2c, author = {fumik0}, title = {{Let’s dig into Vidar – An Arkei Copycat/Forked Stealer (In-depth analysis)}}, date = {2018-12-24}, organization = {fumik0 blog}, url = {https://fumik0.com/2018/12/24/lets-dig-into-vidar-an-arkei-copycat-forked-stealer-in-depth-analysis/}, language = {English}, urldate = {2022-01-12} } Let’s dig into Vidar – An Arkei Copycat/Forked Stealer (In-depth analysis)
Arkei Stealer Vidar
Yara Rules
[TLP:WHITE] win_vidar_auto (20220516 | Detects win.vidar.)
rule win_vidar_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2022-05-16"
        version = "1"
        description = "Detects win.vidar."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar"
        malpedia_rule_date = "20220513"
        malpedia_hash = "7f4b2229e6ae614d86d74917f6d5b41890e62a26"
        malpedia_version = "20220516"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8b742408 8b06 8b4804 6a0a }
            // n = 4, score = 1800
            //   8b742408             | mov                 esi, dword ptr [esp + 8]
            //   8b06                 | mov                 eax, dword ptr [esi]
            //   8b4804               | mov                 ecx, dword ptr [eax + 4]
            //   6a0a                 | push                0xa

        $sequence_1 = { 8d7801 8a10 40 84d2 75f9 2bc7 83c104 }
            // n = 7, score = 1800
            //   8d7801               | lea                 edi, [eax + 1]
            //   8a10                 | mov                 dl, byte ptr [eax]
            //   40                   | inc                 eax
            //   84d2                 | test                dl, dl
            //   75f9                 | jne                 0xfffffffb
            //   2bc7                 | sub                 eax, edi
            //   83c104               | add                 ecx, 4

        $sequence_2 = { 83f8ff 7503 32c0 c3 8b4c2404 8801 b001 }
            // n = 7, score = 1800
            //   83f8ff               | cmp                 eax, -1
            //   7503                 | jne                 5
            //   32c0                 | xor                 al, al
            //   c3                   | ret                 
            //   8b4c2404             | mov                 ecx, dword ptr [esp + 4]
            //   8801                 | mov                 byte ptr [ecx], al
            //   b001                 | mov                 al, 1

        $sequence_3 = { 8b4804 6a0a 03ce e8???????? 0fb6c0 50 ff742410 }
            // n = 7, score = 1800
            //   8b4804               | mov                 ecx, dword ptr [eax + 4]
            //   6a0a                 | push                0xa
            //   03ce                 | add                 ecx, esi
            //   e8????????           |                     
            //   0fb6c0               | movzx               eax, al
            //   50                   | push                eax
            //   ff742410             | push                dword ptr [esp + 0x10]

        $sequence_4 = { c9 c3 8b542408 85d2 7503 33c0 }
            // n = 6, score = 1800
            //   c9                   | leave               
            //   c3                   | ret                 
            //   8b542408             | mov                 edx, dword ptr [esp + 8]
            //   85d2                 | test                edx, edx
            //   7503                 | jne                 5
            //   33c0                 | xor                 eax, eax

        $sequence_5 = { a900400000 7407 8bc6 e8???????? }
            // n = 4, score = 1800
            //   a900400000           | test                eax, 0x4000
            //   7407                 | je                  9
            //   8bc6                 | mov                 eax, esi
            //   e8????????           |                     

        $sequence_6 = { 8d8d40feffff 51 50 e8???????? }
            // n = 4, score = 1800
            //   8d8d40feffff         | lea                 ecx, [ebp - 0x1c0]
            //   51                   | push                ecx
            //   50                   | push                eax
            //   e8????????           |                     

        $sequence_7 = { 5e c20400 b001 c3 33c0 }
            // n = 5, score = 1800
            //   5e                   | pop                 esi
            //   c20400               | ret                 4
            //   b001                 | mov                 al, 1
            //   c3                   | ret                 
            //   33c0                 | xor                 eax, eax

        $sequence_8 = { c20800 56 57 8b7c240c 8b07 8bf1 }
            // n = 6, score = 1800
            //   c20800               | ret                 8
            //   56                   | push                esi
            //   57                   | push                edi
            //   8b7c240c             | mov                 edi, dword ptr [esp + 0xc]
            //   8b07                 | mov                 eax, dword ptr [edi]
            //   8bf1                 | mov                 esi, ecx

        $sequence_9 = { 8d4644 6804010000 50 e8???????? 8b4638 83c410 33c9 }
            // n = 7, score = 1800
            //   8d4644               | lea                 eax, [esi + 0x44]
            //   6804010000           | push                0x104
            //   50                   | push                eax
            //   e8????????           |                     
            //   8b4638               | mov                 eax, dword ptr [esi + 0x38]
            //   83c410               | add                 esp, 0x10
            //   33c9                 | xor                 ecx, ecx

        $sequence_10 = { c20400 56 8bf1 8b4e20 33c0 3901 7405 }
            // n = 7, score = 1800
            //   c20400               | ret                 4
            //   56                   | push                esi
            //   8bf1                 | mov                 esi, ecx
            //   8b4e20               | mov                 ecx, dword ptr [esi + 0x20]
            //   33c0                 | xor                 eax, eax
            //   3901                 | cmp                 dword ptr [ecx], eax
            //   7405                 | je                  7

        $sequence_11 = { c20400 ff742408 e8???????? 59 83f8ff }
            // n = 5, score = 1800
            //   c20400               | ret                 4
            //   ff742408             | push                dword ptr [esp + 8]
            //   e8????????           |                     
            //   59                   | pop                 ecx
            //   83f8ff               | cmp                 eax, -1

        $sequence_12 = { a1???????? 33c5 8985f8210000 53 }
            // n = 4, score = 1800
            //   a1????????           |                     
            //   33c5                 | xor                 eax, ebp
            //   8985f8210000         | mov                 dword ptr [ebp + 0x21f8], eax
            //   53                   | push                ebx

        $sequence_13 = { 8d4dd0 e8???????? 8d8570fdffff 68???????? }
            // n = 4, score = 1800
            //   8d4dd0               | lea                 ecx, [ebp - 0x30]
            //   e8????????           |                     
            //   8d8570fdffff         | lea                 eax, [ebp - 0x290]
            //   68????????           |                     

        $sequence_14 = { 8b4508 8906 8b450c 894608 8b4510 }
            // n = 5, score = 1700
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8906                 | mov                 dword ptr [esi], eax
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   894608               | mov                 dword ptr [esi + 8], eax
            //   8b4510               | mov                 eax, dword ptr [ebp + 0x10]

        $sequence_15 = { dd45f0 dd1c24 83ec08 dd4508 dd1c24 6a0b 6a10 }
            // n = 7, score = 200
            //   dd45f0               | fld                 qword ptr [ebp - 0x10]
            //   dd1c24               | fstp                qword ptr [esp]
            //   83ec08               | sub                 esp, 8
            //   dd4508               | fld                 qword ptr [ebp + 8]
            //   dd1c24               | fstp                qword ptr [esp]
            //   6a0b                 | push                0xb
            //   6a10                 | push                0x10

        $sequence_16 = { dd4508 dd1c24 6a0b 6a08 e8???????? 83c41c }
            // n = 6, score = 200
            //   dd4508               | fld                 qword ptr [ebp + 8]
            //   dd1c24               | fstp                qword ptr [esp]
            //   6a0b                 | push                0xb
            //   6a08                 | push                8
            //   e8????????           |                     
            //   83c41c               | add                 esp, 0x1c

        $sequence_17 = { e8???????? 83c408 84c0 740e 68???????? }
            // n = 5, score = 200
            //   e8????????           |                     
            //   83c408               | add                 esp, 8
            //   84c0                 | test                al, al
            //   740e                 | je                  0x10
            //   68????????           |                     

        $sequence_18 = { 75f9 8b4c2410 2bc6 50 52 e8???????? }
            // n = 6, score = 200
            //   75f9                 | jne                 0xfffffffb
            //   8b4c2410             | mov                 ecx, dword ptr [esp + 0x10]
            //   2bc6                 | sub                 eax, esi
            //   50                   | push                eax
            //   52                   | push                edx
            //   e8????????           |                     

        $sequence_19 = { 745f 660f6e05???????? 0f5bc0 51 f30f110424 e8???????? }
            // n = 6, score = 100
            //   745f                 | je                  0x61
            //   660f6e05????????     |                     
            //   0f5bc0               | cvtdq2ps            xmm0, xmm0
            //   51                   | push                ecx
            //   f30f110424           | movss               dword ptr [esp], xmm0
            //   e8????????           |                     

        $sequence_20 = { 745f 8b35???????? 0f57c0 2b35???????? }
            // n = 4, score = 100
            //   745f                 | je                  0x61
            //   8b35????????         |                     
            //   0f57c0               | xorps               xmm0, xmm0
            //   2b35????????         |                     

    condition:
        7 of them and filesize < 2793472
}
[TLP:WHITE] win_vidar_w0   (20190106 | Yara rule for detecting Vidar stealer)
rule win_vidar_w0 {
    meta:
        description = "Yara rule for detecting Vidar stealer"
        author = "Fumik0_"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar"
        malpedia_version = "20190106"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $s1 = { 56 69 64 61 72 }
        $s2 = { 31 42 45 46 30 41 35 37 42 45 31 31 30 46 44 34 36 37 41 }
        
    condition:
        all of them
}
Download all Yara Rules