SYMBOLCOMMON_NAMEaka. SYNONYMS
win.vidar (Back to overview)

Vidar

VTCollection    

Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.

References
2026-10-01 ⋅ Netskope ⋅ Jan Michael Alcantara, John Carlo Marquez, Vini Egerland
$100k in Crypto Drained by the Underground Operation
Vidar
2026-09-30 ⋅ Zscaler ⋅ Muhammed Irfan V A
2CLoader: A New Malware Loader Delivering Vidar and Remus
2CLoader Remus Vidar XWorm
2026-09-21 ⋅ Zscaler ⋅ Ismael Garcia Perez
Vidar Virtual Machine-Based String Obfuscation
Vidar
2026-06-18 ⋅ Gen Digital ⋅ Vojtěch Krejsa
Inside Vidar’s ABE Bypass: From Memory Scanning to APC Injections
Vidar
2026-06-15 ⋅ Medium (@mrtiepolo) ⋅ Gianluca Tiepolo
Operation Turb00 — Part 1: Analyzing and Hunting a Vidar Campaign
Vidar
2026-05-19 ⋅ Microsoft ⋅ Microsoft Threat Intelligence
Exposing Fox Tempest: A malware-signing service operation (Podcast)
Akira Rhysida Akira BlackByte BlueSky Broomstick Lumma Stealer Rhysida Spyder Vidar Fox Tempest
2026-05-19 ⋅ Microsoft ⋅ Steven Masada
Disrupting Fox Tempest: A cybercrime service that turned “verified” software into a pathway for ransomware
Akira INC Qilin Rhysida AgendaCrypt Akira Broomstick INC Lumma Stealer Rhysida Vidar Fox Tempest
2026-05-19 ⋅ The Record ⋅ Jonathan Greig
Microsoft disrupts Fox Tempest malware-signing-as-a-service platform tied to ransomware gangs
Akira INC Qilin Rhysida AgendaCrypt Akira Broomstick INC Lumma Stealer Rhysida Vidar Fox Tempest
2026-05-16 ⋅ Derp ⋅ Matt Kirkland
Vidar v1.5 in Go: same family, new language, heavy sandbox checks
Vidar
2026-05-07 ⋅ Netskope ⋅ Vini Egerland
OpenClaw hologram: Fake installer ships Rust Infostealer
Vidar
2026-04-03 ⋅ Trend Micro ⋅ Jacob Santos, Jeffrey Francis Bonaobra, Sophia Nilette Robles
Weaponizing Trust Signals: Claude Code Lures and GitHub Release Payloads
GhostSocks Vidar
2026-04-01 ⋅ Zscalar ⋅ Avinash Kumar, Jithin Prajeev Nair, Mallikarjun Piddannavar, Manisha Ramcharan Prajapati
Anthropic Claude Code Leak
GhostSocks Vidar
2026-03-04 ⋅ Huntress Labs ⋅ Jai Minton, Ryan Dowd
"Malware, from the Outside!": How a Threat Actor Used Fake OpenClaw Installers to Infect Systems with GhostSocks and Information Stealers
GhostSocks Vidar
2026-01-13 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Spamhaus Botnet Threat Update July to December 2025
Coper FluBot Joker Aisuru Mirai AsyncRAT BianLian Cobalt Strike DCRat Havoc Latrodectus PureLogs Stealer Quasar RAT Remcos Rhadamanthys Sliver ValleyRAT Venom RAT Vidar XWorm
2025-10-21 ⋅ Trend Micro ⋅ Junestherry Dela Cruz
Fast, Broad, and Elusive: How Vidar Stealer 2.0 Upgrades Infostealer Capabilities
Vidar
2025-08-28 ⋅ Aryaka Networks ⋅ bikash dash, varadharajan krishnasamy
Vidar Infostealer in Action From API Hooking to Covert Data Exfiltration
Vidar
2025-08-12 ⋅ bluecyber ⋅ Khắc Minh
Analysis of a ClickFix malware attack
Vidar
2025-05-21 ⋅ Trendmicro ⋅ Junestherry Dela Cruz
TikTok Videos Promise Pirated Apps, Deliver Vidar and StealC Infostealers Instead
Stealc Vidar
2025-03-23 ⋅ AviaB ⋅ AviaB
Analyzing Vidar Stealer
Vidar
2024-10-17 ⋅ Loader Insight Agency ⋅ LIA
Correlating Vidar Stealer Build IDs Based on Loader Tasks
Lumma Stealer SmokeLoader Vidar
2024-07-22 ⋅ Censys ⋅ Censys, Embee_research
A Beginner’s Guide to Hunting Malicious Open Directories
Cobalt Strike Lumma Stealer Vidar
2024-07-02 ⋅ Sekoia ⋅ Quentin Bourgue
Exposing FakeBat loader: distribution methods and adversary infrastructure
BlackCat Royal Ransom EugenLoader Carbanak Cobalt Strike DICELOADER Gozi IcedID Lumma Stealer NetSupportManager RAT Pikabot RedLine Stealer SectopRAT Sliver SmokeLoader Vidar
2024-06-10 ⋅ Mandiant ⋅ Mandiant
UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion
Lumma Stealer MetaStealer Raccoon RedLine Stealer RisePro Vidar UNC5537
2024-03-01 ⋅ Logpoint ⋅ Nischal khadgi
A Comprehensive Overview on Stealer Malware Families
Agent Tesla Formbook RedLine Stealer Remcos Vidar
2023-12-15 ⋅ ⋅ Gatewatcher ⋅ Gatewatcher
Utilisation de faux profils Steam : Vidar Stealer prend les commandes
Vidar
2023-12-06 ⋅ Twitter (@embee_research) ⋅ Embee_research
Ghidra Basics - Identifying, Decoding and Fixing Encrypted Strings
Vidar
2023-11-30 ⋅ Medium g0njxa ⋅ g0njxa
Approaching stealers devs : a brief interview with Vidar
Vidar
2023-11-21 ⋅ Censys ⋅ Aidan Holland
Tracking Vidar Infrastructure with Censys
Vidar
2023-11-16 ⋅ CISA ⋅ CISA
Scattered Spider
BlackCat Ave Maria Raccoon Vidar
2023-11-16 ⋅ CISA ⋅ CISA
Scattered Spider
Ave Maria BlackCat Raccoon Vidar
2023-10-27 ⋅ Elastic ⋅ Joe Desimone, Salim Bitam
GHOSTPULSE haunts victims using defense evasion bag o' tricks
HijackLoader Lumma Stealer NetSupportManager RAT Rhadamanthys SectopRAT Vidar
2023-10-25 ⋅ Viuleeenz ⋅ Alessandro Strino
Vidar - payload inspection with static analysis
Vidar
2023-10-12 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Spamhaus Botnet Threat Update Q3 2023
FluBot AsyncRAT Ave Maria Cobalt Strike DCRat Havoc IcedID ISFB Nanocore RAT NjRAT QakBot Quasar RAT RecordBreaker RedLine Stealer Remcos Rhadamanthys Sliver Stealc Tofsee Vidar
2023-07-24 ⋅ M4lcode ⋅ Mostafa Farghaly
Deep Analysis of Vidar Stealer
Arkei Stealer Vidar
2023-06-15 ⋅ Team Cymru ⋅ S2 Research Team
Darth Vidar: The Aesir Strike Back
Vidar
2023-05-16 ⋅ Secureworks ⋅ Counter Threat Unit ResearchTeam
The Growing Threat from Infostealers
Graphiron GraphSteel Raccoon RedLine Stealer Rhadamanthys Taurus Stealer Vidar
2023-05-09 ⋅ eSentire ⋅ RussianPanda
eSentire Threat Intelligence Malware Analysis: Vidar Stealer
Vidar
2023-04-12 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Spamhaus Botnet Threat Update Q1 2023
FluBot Amadey AsyncRAT Aurora Ave Maria BumbleBee Cobalt Strike DCRat Emotet IcedID ISFB NjRAT QakBot RecordBreaker RedLine Stealer Remcos Rhadamanthys Sliver Tofsee Vidar
2023-03-30 ⋅ eSentire ⋅ eSentire Threat Response Unit (TRU)
eSentire Threat Intelligence Malware Analysis: BatLoader
BATLOADER Cobalt Strike ISFB SystemBC Vidar
2023-03-09 ⋅ eSentire ⋅ eSentire Threat Response Unit (TRU)
BatLoader Continues to Abuse Google Search Ads to Deliver Vidar Stealer and Ursnif
BATLOADER ISFB Vidar
2023-02-20 ⋅ 0xToxin Labs ⋅ @0xToxin
Vidar Stealer H&M Campaign
Vidar
2023-02-06 ⋅ Quorum Cyber ⋅ Quorum Cyber
Malware Analysis Report Vidar - Stealerware
Vidar
2023-02-03 ⋅ Cloudsek ⋅ Deepanjli Paulraj, Pavan Karthick M
Threat Actors Abuse AI-Generated Youtube Videos to Spread Stealer Malware
Alfonso Stealer Bandit Stealer Cameleon Fabookie Lumma Stealer Nanocore RAT Panda Stealer RecordBreaker RedLine Stealer Stealc STOP Vidar zgRAT
2023-02-02 ⋅ YouTube (SLEUTHCON) ⋅ Christopher Glyer, Microsoft Threat Intelligence Center (MSTIC)
Lions, Tigers, and Infostealers - Oh my!
RecordBreaker RedLine Stealer Vidar
2023-01-31 ⋅ Darktrace ⋅ Roberto Martinez
Vidar Info-Stealer Malware Distributed via Malvertising on Google
Vidar
2023-01-24 ⋅ Fortinet ⋅ Geri Revay
The Year of the Wiper
Azov Wiper Bruh Wiper CaddyWiper Cobalt Strike Vidar
2023-01-19 ⋅ Emerging Threats ⋅ Isaac O'Shaughnessy
Vidar Stealer Picks Up Steam!
Vidar
2023-01-19 ⋅ Team Cymru ⋅ S2 Research Team
Darth Vidar: The Dark Side of Evolving Threat Infrastructure
Vidar
2023-01-12 ⋅ Cynet ⋅ Ronen Ahdut
CyOps Lighthouse: Vidar Stealer
Vidar
2022-12-31 ⋅ Jaalma's Blog ⋅ Jaalma
Analyzing a VIDAR Infostealer Sample
Vidar
2022-12-17 ⋅ kienmanowar Blog ⋅ m4n0w4r, Tran Trung Kien
[QuickNote] VidarStealer Analysis
Vidar
2022-12-13 ⋅ Kroll ⋅ Dave Truman, George Glass, Keith Wojcieszek, Stephen Green
Threat Actors use Google Ads to Deploy VIDAR Stealer
Vidar
2022-12-08 ⋅ Youtube (AhmedS Kasmani) ⋅ AhmedS Kasmani
Vidar Stealer Malware Analysis
Vidar
2022-11-19 ⋅ Malwarology ⋅ Robert Simmons
Malicious Packer pkr_ce1a
SmokeLoader Vidar
2022-11-15 ⋅ SOC Prime ⋅ Veronika Telychko
Somnia Malware Detection: UAC-0118 aka FRwL Launches Cyber Attacks Against Organizations in Ukraine Using Enhanced Malware Strains
Cobalt Strike Vidar UAC-0118
2022-11-08 ⋅ cyble ⋅ Cyble
Massive YouTube Campaign Targeting Over 100 Applications To Deliver Info Stealer
RecordBreaker Vidar
2022-10-03 ⋅ Check Point ⋅ Marc Salinas Fernandez
Bumblebee: increasing its capacity and evolving its TTPs
BumbleBee Cobalt Strike Meterpreter Sliver Vidar
2022-09-26 ⋅ Kaspersky ⋅ Artem Ushkov, Haim Zigel, Oleg Kupreev
NullMixer: oodles of Trojans in a single dropper
ColdStealer DanaBot GCleaner Nullmixer PrivateLoader PseudoManuscrypt RedLine Stealer SmokeLoader Vidar
2022-09-16 ⋅ Group-IB ⋅ Twitter (@GroupIB_GIB)
Tweet on Uber Employees potentially infected with Raccoon and Vidar stealer
Raccoon Vidar
2022-09-15 ⋅ Sekoia ⋅ Threat & Detection Research Team
PrivateLoader: the loader of the prevalent ruzki PPI service
Agent Tesla Coinminer DanaBot DCRat Eternity Stealer Glupteba Mars Stealer NetSupportManager RAT Nymaim Nymaim2 Phoenix Keylogger PrivateLoader Raccoon RedLine Stealer SmokeLoader Socelars STOP Vidar YTStealer
2022-08-29 ⋅ Sekoia ⋅ Livia Tibirna, Quentin Bourgue, Threat & Detection Research Team
Traffers: a deep dive into the information stealer ecosystem
MetaStealer PrivateLoader Raccoon RedLine Stealer Vidar
2022-08-08 ⋅ Medium CSIS Techblog ⋅ Benoît Ancel
An inside view of domain anonymization as-a-service — the BraZZZerSFF infrastructure
Riltok magecart Anubis Azorult BetaBot Buer CoalaBot CryptBot DiamondFox DreamBot GCleaner ISFB Loki Password Stealer (PWS) MedusaLocker MeguminTrojan Nemty PsiX RedLine Stealer SmokeLoader STOP TinyNuke Vidar Zloader
2022-08-02 ⋅ Recorded Future ⋅ Insikt Group
Initial Access Brokers Are Key to Rise in Ransomware Attacks
Azorult BlackMatter Conti Mars Stealer Raccoon RedLine Stealer Taurus Stealer Vidar
2022-07-13 ⋅ KELA ⋅ KELA Cyber Intelligence Center
The Next Generation of Info Stealers
Arkei Stealer Azorult BlackGuard Eternity Stealer Ginzo Stealer Mars Stealer MetaStealer Raccoon RedLine Stealer Vidar
2022-05-19 ⋅ Zscaler ⋅ Brett Stone-Gross, Santiago Vicente, Sudeep Singh
Vidar distributed through backdoored Windows 11 downloads and abusing Telegram
Vidar
2022-05-18 ⋅ Github (0x00-0x7f) ⋅ Sadia Bashir
A Case of Vidar Infostealer - Part 2
Vidar
2022-05-15 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Fake Pixelmon NFT site infects you with password-stealing malware
Vidar
2022-03-27 ⋅ Github (0x00-0x7f) ⋅ Sadia Bashir
A Case of Vidar Infostealer - Part 1 (Unpacking)
Vidar
2022-03-24 ⋅ Trustwave ⋅ Diana Lopera
Vidar Malware Launcher Concealed in Help File
Vidar
2022-03-24 ⋅ CSO Online ⋅ Jon Gold
Microsoft help files repurposed to contain Vidar malware in new campaign
Vidar
2022-03-24 ⋅ Threat Post ⋅ Nate Nelson
Microsoft Help Files Disguise Vidar Malware
Vidar
2022-03-23 ⋅ InfoSec Handlers Diary Blog ⋅ Brad Duncan
Arkei Variants: From Vidar to Mars Stealer
Arkei Stealer Mars Stealer Oski Stealer Vidar
2022-03-23 ⋅ InfoSec Handlers Diary Blog ⋅ Brad Duncan
Arkei Variants: From Vidar to Mars Stealer
Arkei Stealer Mars Stealer Vidar
2022-02-08 ⋅ Intel 471 ⋅ Intel 471
PrivateLoader: The first step in many malware schemes
Dridex Kronos LockBit Nanocore RAT NjRAT PrivateLoader Quasar RAT RedLine Stealer Remcos SmokeLoader STOP Tofsee TrickBot Vidar
2022-02-06 ⋅ Github (eln0ty) ⋅ Abdallah Elnoty
Deep Analysis of Vidar Information Stealer
Vidar
2022-01-26 ⋅ AhnLab ⋅ ASEC Analysis Team
Vidar Exploiting Social Media Platform (Mastodon)
Vidar
2022-01-03 ⋅ AhnLab ⋅ ASEC Analysis Team
Distribution of Redline Stealer Disguised as Software Crack
DanaBot RedLine Stealer Vidar
2021-10-27 ⋅ CERT.PL ⋅ CERT.PL
Vidar stealer campaign targeting Baltic region and NATO entities
Vidar
2021-09-27 ⋅ Trend Micro ⋅ Arianne Dela Cruz, Gilbert Sison, Joelson Soares, Ryan Maglaque, Warren Sto.Tomas
Fake Installers Drop Malware and Open Doors for Opportunistic Attackers
RedLine Stealer Socelars Vidar
2021-09-23 ⋅ Minerva Labs ⋅ Minerva Labs
Vidar Stealer Evasion Arsenal
Vidar
2021-08-04 ⋅ ⋅ ASEC ⋅ ASEC
S/W Download Camouflage, Spreading Various Kinds of Malware
Raccoon RedLine Stealer Remcos Vidar
2021-07-16 ⋅ Malwarebytes Labs ⋅ Jérôme Segura
Vidar and GandCrab: stealer and ransomware combo observed in the wild
Gandcrab Vidar
2021-07-15 ⋅ Twitter (@hypen1117) ⋅ Hypen
Vidar Stealer C&C Server List
Vidar
2021-06-29 ⋅ Twitter (@sisoma2) ⋅ sisoma2
Tweet on vidar stealer using Tumblr to obtain dynamic config
Vidar
2021-05-28 ⋅ Medium s2wlab ⋅ Sojun Ryu
Deep Analysis of Vidar Stealer
Vidar
2021-05-24 ⋅ AhnLab ⋅ ASEC Analysis Team
Vidar Info-Stealer Abusing Game Platform
Vidar
2021-02-03 ⋅ Medium s2wlab ⋅ Hyunmin Suh, Minjei Cho
W1 Feb| EN | Story of the week: Stealers on the Darkweb
Azorult Raccoon Vidar
2020-03-04 ⋅ CrowdStrike ⋅ CrowdStrike
2020 CrowdStrike Global Threat Report
MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelDridex DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze MECHANICAL Necurs Nokki Outlook Backdoor Phobos Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot Vidar Winnti ANTHROPOID SPIDER APT23 APT31 APT39 APT40 BlackTech BuhTrap Charming Kitten CLOCKWORK SPIDER DOPPEL SPIDER FIN7 Gamaredon Group GOBLIN PANDA MONTY SPIDER MUSTANG PANDA NARWHAL SPIDER NOCTURNAL SPIDER PINCHY SPIDER SALTY SPIDER SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER VICEROY TIGER
2020-02-05 ⋅ Cybereason ⋅ Assaf Dahan, Lior Rochberger
The Hole in the Bucket: Attackers Abuse Bitbucket to Deliver an Arsenal of Malware
Amadey Azorult Predator The Thief STOP Vidar
2019-03-11 ⋅ tcontre
Infor Stealer Vidar TrojanSpy Analysis...
Vidar
2019-01-07 ⋅ Bleeping Computer ⋅ Ionut Ilascu
GandCrab Operators Use Vidar Infostealer as a Forerunner
Gandcrab Vidar
2018-12-24 ⋅ fumik0 blog ⋅ fumik0
Let’s dig into Vidar – An Arkei Copycat/Forked Stealer (In-depth analysis)
Arkei Stealer Vidar
Yara Rules
[TLP:WHITE] win_vidar_auto (20260917 | Detects win.vidar.)
rule win_vidar_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.vidar."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 05c39e2600 894114 c1e810 25ff7f0000 c3 e8???????? 8b486c }
            // n = 7, score = 2600
            //   05c39e2600           | add                 eax, 0x269ec3
            //   894114               | mov                 dword ptr [ecx + 0x14], eax
            //   c1e810               | shr                 eax, 0x10
            //   25ff7f0000           | and                 eax, 0x7fff
            //   c3                   | ret                 
            //   e8????????           |                     
            //   8b486c               | mov                 ecx, dword ptr [eax + 0x6c]

        $sequence_1 = { 7202 8b00 8d8d68fdffff 51 50 ff15???????? }
            // n = 6, score = 2500
            //   7202                 | jb                  4
            //   8b00                 | mov                 eax, dword ptr [eax]
            //   8d8d68fdffff         | lea                 ecx, [ebp - 0x298]
            //   51                   | push                ecx
            //   50                   | push                eax
            //   ff15????????         |                     

        $sequence_2 = { 89b55cfdffff 89bd60fdffff 8d450c 50 }
            // n = 4, score = 2400
            //   89b55cfdffff         | mov                 dword ptr [ebp - 0x2a4], esi
            //   89bd60fdffff         | mov                 dword ptr [ebp - 0x2a0], edi
            //   8d450c               | lea                 eax, [ebp + 0xc]
            //   50                   | push                eax

        $sequence_3 = { 56 8b742408 8b865caf0100 57 }
            // n = 4, score = 2400
            //   56                   | mov                 edi, edi
            //   8b742408             | push                ebp
            //   8b865caf0100         | mov                 ebp, esp
            //   57                   | push                0xa

        $sequence_4 = { 740a b800000500 e9???????? 57 }
            // n = 4, score = 2400
            //   740a                 | and                 eax, 0x7fff
            //   b800000500           | ret                 
            //   e9????????           |                     
            //   57                   | shr                 eax, 0x10

        $sequence_5 = { e8???????? d9450c 51 8d8d58ffffff }
            // n = 4, score = 2400
            //   e8????????           |                     
            //   d9450c               | fld                 dword ptr [ebp + 0xc]
            //   51                   | push                ecx
            //   8d8d58ffffff         | lea                 ecx, [ebp - 0xa8]

        $sequence_6 = { 8b7508 33ff 89b55cfdffff 89bd60fdffff }
            // n = 4, score = 2400
            //   8b7508               | mov                 esi, dword ptr [ebp + 8]
            //   33ff                 | xor                 edi, edi
            //   89b55cfdffff         | mov                 dword ptr [ebp - 0x2a4], esi
            //   89bd60fdffff         | mov                 dword ptr [ebp - 0x2a0], edi

        $sequence_7 = { 895dfc e8???????? 83781408 c645fc01 7202 }
            // n = 5, score = 2400
            //   895dfc               | mov                 dword ptr [ebp - 4], ebx
            //   e8????????           |                     
            //   83781408             | cmp                 dword ptr [eax + 0x14], 8
            //   c645fc01             | mov                 byte ptr [ebp - 4], 1
            //   7202                 | jb                  4

        $sequence_8 = { 8b8648af0100 c1e803 038644af0100 5e 5d c3 }
            // n = 6, score = 2400
            //   8b8648af0100         | mov                 eax, dword ptr [esi + 0x1af48]
            //   c1e803               | shr                 eax, 3
            //   038644af0100         | add                 eax, dword ptr [esi + 0x1af44]
            //   5e                   | pop                 esi
            //   5d                   | pop                 ebp
            //   c3                   | ret                 

        $sequence_9 = { 5f c6043300 8bc6 5e 5b c20400 }
            // n = 6, score = 2400
            //   5f                   | push                0xa
            //   c6043300             | pop                 ecx
            //   8bc6                 | pop                 ecx
            //   5e                   | push                eax
            //   5b                   | push                6
            //   c20400               | shr                 eax, 0x10

        $sequence_10 = { 895dd0 c746140f000000 895e10 8975cc 881e }
            // n = 5, score = 2400
            //   895dd0               | mov                 dword ptr [ebp - 0x30], ebx
            //   c746140f000000       | mov                 dword ptr [esi + 0x14], 0xf
            //   895e10               | mov                 dword ptr [esi + 0x10], ebx
            //   8975cc               | mov                 dword ptr [ebp - 0x34], esi
            //   881e                 | mov                 byte ptr [esi], bl

        $sequence_11 = { 50 ff15???????? 8b4da0 8901 85c0 }
            // n = 5, score = 2300
            //   50                   | push                0x1fffc
            //   ff15????????         |                     
            //   8b4da0               | lea                 eax, [esi + 0x4af70]
            //   8901                 | push                ebx
            //   85c0                 | push                eax

        $sequence_12 = { 6819010200 53 68???????? 6802000080 ff15???????? 85c0 751b }
            // n = 7, score = 2300
            //   6819010200           | mov                 eax, dword ptr [esi + 0x1af48]
            //   53                   | shr                 eax, 3
            //   68????????           |                     
            //   6802000080           | add                 eax, dword ptr [esi + 0x1af44]
            //   ff15????????         |                     
            //   85c0                 | pop                 esi
            //   751b                 | pop                 ebp

        $sequence_13 = { 83781410 7202 8b00 50 8b45a0 }
            // n = 5, score = 2300
            //   83781410             | push                ebx
            //   7202                 | push                eax
            //   8b00                 | mov                 dword ptr [esi + 0x6af6c], ebx
            //   50                   | mov                 dword ptr [esi + 0x6af78], 1
            //   8b45a0               | mov                 dword ptr [esi + 0x6af70], 0x10000

        $sequence_14 = { 5e c20400 ff742408 e8???????? 59 83f8ff 7503 }
            // n = 7, score = 2300
            //   5e                   | mov                 dword ptr [ebp - 0x2a0], edi
            //   c20400               | mov                 esi, dword ptr [ebp + 8]
            //   ff742408             | xor                 edi, edi
            //   e8????????           |                     
            //   59                   | mov                 dword ptr [ebp - 0x2a4], esi
            //   83f8ff               | mov                 dword ptr [ebp - 0x2a0], edi
            //   7503                 | lea                 eax, [ebp + 0xc]

        $sequence_15 = { c1e005 0bc1 8b4df4 668906 8b45f6 c1e106 }
            // n = 6, score = 2300
            //   c1e005               | push                0x1fffc
            //   0bc1                 | lea                 eax, [esi + 0x4af70]
            //   8b4df4               | push                ebx
            //   668906               | jne                 0x16
            //   8b45f6               | mov                 dword ptr [esi + 0x6af78], 1
            //   c1e106               | mov                 dword ptr [esi + 0x6af70], 0x10000

        $sequence_16 = { c1e004 8bf0 0fbe4301 50 }
            // n = 4, score = 2300
            //   c1e004               | mov                 esi, dword ptr [ebp + 8]
            //   8bf0                 | xor                 edi, edi
            //   0fbe4301             | mov                 dword ptr [ebp - 0x2a4], esi
            //   50                   | mov                 dword ptr [ebp - 0x2a0], edi

        $sequence_17 = { c9 c3 8b542408 85d2 7503 33c0 }
            // n = 6, score = 2300
            //   c9                   | push                0
            //   c3                   | push                dword ptr [esp + 0xc]
            //   8b542408             | ret                 4
            //   85d2                 | push                esi
            //   7503                 | mov                 esi, ecx
            //   33c0                 | push                0

        $sequence_18 = { 68???????? e8???????? 59 83f820 }
            // n = 4, score = 2200
            //   68????????           |                     
            //   e8????????           |                     
            //   59                   | add                 eax, dword ptr [esi + 0x1af44]
            //   83f820               | pop                 esi

        $sequence_19 = { 50 6a09 53 68???????? }
            // n = 4, score = 2200
            //   50                   | jb                  0xc
            //   6a09                 | mov                 eax, dword ptr [eax]
            //   53                   | mov                 dword ptr [ebp - 4], ebx
            //   68????????           |                     

        $sequence_20 = { 0fb605???????? 50 0fb605???????? 50 6a01 }
            // n = 5, score = 2200
            //   0fb605????????       |                     
            //   50                   | push                9
            //   0fb605????????       |                     
            //   50                   | push                ebx
            //   6a01                 | mov                 dword ptr [ebp - 0x10], ebx

        $sequence_21 = { 399e70af0600 7514 c78678af060001000000 c78670af060000000100 68fcff0100 8d8670af0400 53 }
            // n = 7, score = 2100
            //   399e70af0600         | and                 eax, 0x7fff
            //   7514                 | ret                 
            //   c78678af060001000000     | mov    dword ptr [ecx + 0x14], eax
            //   c78670af060000000100     | shr    eax, 0x10
            //   68fcff0100           | and                 eax, 0x7fff
            //   8d8670af0400         | ret                 
            //   53                   | mov                 ecx, dword ptr [eax + 0x6c]

        $sequence_22 = { 50 53 ff75f0 ff15???????? 3bc3 }
            // n = 5, score = 2100
            //   50                   | push                eax
            //   53                   | push                9
            //   ff75f0               | je                  0x1f
            //   ff15????????         |                     
            //   3bc3                 | push                dword ptr [ebp - 0x10]

        $sequence_23 = { 53 68???????? 8d8da8000000 e8???????? }
            // n = 4, score = 2100
            //   53                   | and                 eax, 0x7fff
            //   68????????           |                     
            //   8d8da8000000         | ret                 
            //   e8????????           |                     

        $sequence_24 = { 895df0 8d45f0 50 6a09 }
            // n = 4, score = 2100
            //   895df0               | pop                 ecx
            //   8d45f0               | pop                 ecx
            //   50                   | push                eax
            //   6a09                 | push                9

        $sequence_25 = { 741d ff75f0 ff15???????? 895df0 }
            // n = 4, score = 2100
            //   741d                 | push                ebx
            //   ff75f0               | push                eax
            //   ff15????????         |                     
            //   895df0               | mov                 eax, ecx

        $sequence_26 = { 53 50 899e6caf0600 e8???????? }
            // n = 4, score = 2100
            //   53                   | mov                 ecx, dword ptr [eax + 0x6c]
            //   50                   | mov                 dword ptr [ecx + 0x14], eax
            //   899e6caf0600         | shr                 eax, 0x10
            //   e8????????           |                     

        $sequence_27 = { 0fbe4301 50 8bc1 50 e8???????? }
            // n = 5, score = 2100
            //   0fbe4301             | shl                 eax, 4
            //   50                   | mov                 esi, eax
            //   8bc1                 | movsx               eax, byte ptr [ebx + 1]
            //   50                   | push                eax
            //   e8????????           |                     

        $sequence_28 = { c3 55 8bec 83ec0c 8365fc00 8365f400 8365f800 }
            // n = 7, score = 1900
            //   c3                   | mov                 dword ptr [ebp - 0x10], ebx
            //   55                   | lea                 eax, [ebp - 0x10]
            //   8bec                 | push                eax
            //   83ec0c               | push                9
            //   8365fc00             | je                  0x1f
            //   8365f400             | push                dword ptr [ebp - 0x10]
            //   8365f800             | mov                 dword ptr [ebp - 0x10], ebx

        $sequence_29 = { c20400 56 8bf1 e8???????? 6a00 ff74240c }
            // n = 6, score = 1800
            //   c20400               | ret                 4
            //   56                   | push                dword ptr [esp + 8]
            //   8bf1                 | pop                 ecx
            //   e8????????           |                     
            //   6a00                 | cmp                 eax, -1
            //   ff74240c             | jne                 0xd

        $sequence_30 = { e8???????? c9 c3 55 8bec 83ec18 8b450c }
            // n = 7, score = 1800
            //   e8????????           |                     
            //   c9                   | cmp                 dword ptr [ebp - 0x10], ebx
            //   c3                   | je                  0x17
            //   55                   | push                dword ptr [ebp - 0x10]
            //   8bec                 | je                  0xe
            //   83ec18               | push                dword ptr [ebp - 0x10]
            //   8b450c               | mov                 dword ptr [ebp - 0x10], ebx

        $sequence_31 = { 8b4508 8906 8b450c 894608 }
            // n = 4, score = 1800
            //   8b4508               | lea                 ecx, [ebp - 0x81]
            //   8906                 | mov                 dword ptr [ebp - 4], esi
            //   8b450c               | push                eax
            //   894608               | pop                 esi

        $sequence_32 = { 8d852cffffff 50 8d459c 50 }
            // n = 4, score = 1800
            //   8d852cffffff         | lea                 eax, [ebp - 0x10]
            //   50                   | je                  0xe
            //   8d459c               | push                dword ptr [ebp - 0x10]
            //   50                   | mov                 dword ptr [ebp - 0x10], ebx

        $sequence_33 = { 8b4120 8910 8b4130 8910 c3 56 }
            // n = 6, score = 1800
            //   8b4120               | pop                 esi
            //   8910                 | ret                 4
            //   8b4130               | push                dword ptr [esp + 8]
            //   8910                 | pop                 ecx
            //   c3                   | cmp                 eax, -1
            //   56                   | mov                 eax, esi

        $sequence_34 = { 0faf450c 50 e8???????? 59 }
            // n = 4, score = 1800
            //   0faf450c             | push                dword ptr [esp + 8]
            //   50                   | pop                 ecx
            //   e8????????           |                     
            //   59                   | cmp                 eax, -1

        $sequence_35 = { 50 ff15???????? 6a1a e8???????? }
            // n = 4, score = 800
            //   50                   | pop                 ecx
            //   ff15????????         |                     
            //   6a1a                 | pop                 ecx
            //   e8????????           |                     

        $sequence_36 = { 6860ea0000 6a00 ff15???????? 50 }
            // n = 4, score = 800
            //   6860ea0000           | lea                 eax, [ebp - 0x10]
            //   6a00                 | push                eax
            //   ff15????????         |                     
            //   50                   | movsx               eax, byte ptr [ebx + 1]

        $sequence_37 = { 5f c21000 8bff 55 8bec 6a0a 6a00 }
            // n = 7, score = 700
            //   5f                   | movsx               eax, byte ptr [ebx + 1]
            //   c21000               | push                eax
            //   8bff                 | mov                 eax, ecx
            //   55                   | push                eax
            //   8bec                 | pop                 ecx
            //   6a0a                 | movsx               eax, byte ptr [ebx + 1]
            //   6a00                 | push                eax

        $sequence_38 = { e8???????? 83c410 85c0 7404 6a99 ebcc }
            // n = 6, score = 600
            //   e8????????           |                     
            //   83c410               | jne                 8
            //   85c0                 | xor                 al, al
            //   7404                 | ret                 
            //   6a99                 | pop                 ecx
            //   ebcc                 | cmp                 eax, -1

        $sequence_39 = { 803800 740a 80780800 7404 33c0 40 }
            // n = 6, score = 500
            //   803800               | xor                 al, al
            //   740a                 | push                dword ptr [esp + 8]
            //   80780800             | pop                 ecx
            //   7404                 | cmp                 eax, -1
            //   33c0                 | jne                 9
            //   40                   | xor                 al, al

        $sequence_40 = { 83e03f 03d2 897110 894104 8911 5e c3 }
            // n = 7, score = 500
            //   83e03f               | mov                 dword ptr [esi], eax
            //   03d2                 | mov                 eax, dword ptr [ebp + 0xc]
            //   897110               | mov                 dword ptr [esi + 8], eax
            //   894104               | mov                 eax, dword ptr [ebp + 8]
            //   8911                 | mov                 dword ptr [esi], eax
            //   5e                   | mov                 eax, dword ptr [ebp + 0xc]
            //   c3                   | mov                 dword ptr [esi + 8], eax

        $sequence_41 = { 5b 5d c3 b84d5a0000 }
            // n = 4, score = 300
            //   5b                   | pop                 ebx
            //   5d                   | pop                 ebp
            //   c3                   | ret                 
            //   b84d5a0000           | mov                 eax, 0x5a4d

        $sequence_42 = { 83f8ff 740c a810 7508 }
            // n = 4, score = 300
            //   83f8ff               | cmp                 eax, -1
            //   740c                 | je                  0xe
            //   a810                 | test                al, 0x10
            //   7508                 | jne                 0xa

        $sequence_43 = { 458bc6 488bd0 488bcf ff15???????? 85c0 }
            // n = 5, score = 200
            //   458bc6               | mov                 dword ptr [ebp - 0x30], ebx
            //   488bd0               | mov                 dword ptr [esi + 0x14], 0xf
            //   488bcf               | mov                 dword ptr [esi + 0x10], ebx
            //   ff15????????         |                     
            //   85c0                 | mov                 dword ptr [ebp - 0x34], esi

        $sequence_44 = { 0f31 48c1e220 480bc2 4c8bc8 e8???????? }
            // n = 5, score = 200
            //   0f31                 | ja                  0xc
            //   48c1e220             | xor                 ecx, eax
            //   480bc2               | mov                 edx, ecx
            //   4c8bc8               | shr                 edx, 0x11
            //   e8????????           |                     

        $sequence_45 = { eb0e 8d41bf 3c05 7705 }
            // n = 4, score = 200
            //   eb0e                 | inc                 ecx
            //   8d41bf               | push                edi
            //   3c05                 | dec                 eax
            //   7705                 | lea                 ebp, [eax - 0x538]

        $sequence_46 = { 8b00 488d6508 5b 5f }
            // n = 4, score = 200
            //   8b00                 | lea                 eax, [ebp + 0xc]
            //   488d6508             | push                eax
            //   5b                   | xor                 edi, edi
            //   5f                   | mov                 dword ptr [ebp - 0x2a4], esi

        $sequence_47 = { eb1a 8d419f 3c05 7705 }
            // n = 4, score = 200
            //   eb1a                 | inc                 ecx
            //   8d419f               | push                ebp
            //   3c05                 | inc                 ecx
            //   7705                 | push                esi

        $sequence_48 = { 57 4154 4155 4156 4157 488da8c8faffff 4881ecf8050000 }
            // n = 7, score = 200
            //   57                   | mov                 eax, edi
            //   4154                 | xor                 edx, edx
            //   4155                 | dec                 eax
            //   4156                 | mov                 ecx, eax
            //   4157                 | push                edi
            //   488da8c8faffff       | inc                 ecx
            //   4881ecf8050000       | push                esp

        $sequence_49 = { ff15???????? 4c8bc7 33d2 488bc8 ff15???????? e8???????? }
            // n = 6, score = 200
            //   ff15????????         |                     
            //   4c8bc7               | dec                 esp
            //   33d2                 | mov                 eax, edi
            //   488bc8               | xor                 edx, edx
            //   ff15????????         |                     
            //   e8????????           |                     

        $sequence_50 = { 8b05???????? 8d4801 0fafc8 f6c101 }
            // n = 4, score = 200
            //   8b05????????         |                     
            //   8d4801               | inc                 esp
            //   0fafc8               | imul                eax, eax
            //   f6c101               | inc                 esp

        $sequence_51 = { 8b05???????? 448b05???????? 448d4801 440fafc8 }
            // n = 4, score = 200
            //   8b05????????         |                     
            //   448b05????????       |                     
            //   448d4801             | mov                 byte ptr [esi], bl
            //   440fafc8             | xor                 ebx, ebx

        $sequence_52 = { eb0b 8b45f4 0500040000 8945f4 }
            // n = 4, score = 200
            //   eb0b                 | test                eax, eax
            //   8b45f4               | je                  6
            //   0500040000           | push                -0x67
            //   8945f4               | jmp                 0xffffffd2

        $sequence_53 = { 8b05???????? 8b15???????? 448d4001 440fafc0 }
            // n = 4, score = 200
            //   8b05????????         |                     
            //   8b15????????         |                     
            //   448d4001             | mov                 esi, dword ptr [ebp + 8]
            //   440fafc0             | xor                 edi, edi

        $sequence_54 = { 8b05???????? 448d4001 440fafc0 41f6c001 }
            // n = 4, score = 200
            //   8b05????????         |                     
            //   448d4001             | mov                 dword ptr [ebp - 0x30], ebx
            //   440fafc0             | mov                 dword ptr [esi + 0x14], 0xf
            //   41f6c001             | mov                 dword ptr [esi + 0x10], ebx

        $sequence_55 = { e8???????? 488bd8 4885c0 0f8507fcffff }
            // n = 4, score = 200
            //   e8????????           |                     
            //   488bd8               | mov                 dword ptr [ebp - 0x30], ebx
            //   4885c0               | mov                 dword ptr [esi + 0x14], 0xf
            //   0f8507fcffff         | mov                 dword ptr [esi + 0x10], ebx

        $sequence_56 = { 8b05???????? 448b0d???????? 448d5001 440fafd0 }
            // n = 4, score = 200
            //   8b05????????         |                     
            //   448b0d????????       |                     
            //   448d5001             | inc                 esp
            //   440fafd0             | lea                 eax, [eax + 1]

        $sequence_57 = { 33c8 8bd1 c1ea11 33d1 }
            // n = 4, score = 200
            //   33c8                 | dec                 eax
            //   8bd1                 | sub                 esp, 0x5f8
            //   c1ea11               | jmp                 0x1c
            //   33d1                 | lea                 eax, [ecx - 0x61]

        $sequence_58 = { 8bc8 c1e10d 33c8 8bd1 }
            // n = 4, score = 200
            //   8bc8                 | mov                 dword ptr [ebp - 0x2a4], esi
            //   c1e10d               | mov                 dword ptr [ebp - 0x2a0], edi
            //   33c8                 | lea                 eax, [ebp + 0xc]
            //   8bd1                 | push                eax

        $sequence_59 = { 8b05???????? 89c1 c1e10d 31c1 89c8 c1e811 }
            // n = 6, score = 200
            //   8b05????????         |                     
            //   89c1                 | mov                 dword ptr [ebp - 0x2a4], esi
            //   c1e10d               | mov                 dword ptr [ebp - 0x2a0], edi
            //   31c1                 | lea                 eax, [ebp + 0xc]
            //   89c8                 | push                eax
            //   c1e811               | mov                 esi, dword ptr [ebp + 8]

        $sequence_60 = { 8b05???????? 8b0d???????? 8d5001 0fafd0 }
            // n = 4, score = 200
            //   8b05????????         |                     
            //   8b0d????????         |                     
            //   8d5001               | mov                 dword ptr [esi + 0x10], ebx
            //   0fafd0               | mov                 dword ptr [ebp - 0x34], esi

        $sequence_61 = { 0fbe0d???????? 3bc1 0f846f020000 8b5508 4b8d0c2e 4c8b4dd0 }
            // n = 6, score = 100
            //   0fbe0d????????       |                     
            //   3bc1                 | or                  eax, edx
            //   0f846f020000         | dec                 esp
            //   8b5508               | mov                 ecx, eax
            //   4b8d0c2e             | inc                 ecx
            //   4c8b4dd0             | push                esp

        $sequence_62 = { 45886500 e8???????? 0fbed0 e8???????? 0fbec8 0fafd1 }
            // n = 6, score = 100
            //   45886500             | inc                 ecx
            //   e8????????           |                     
            //   0fbed0               | push                ebp
            //   e8????????           |                     
            //   0fbec8               | inc                 ecx
            //   0fafd1               | push                esi

        $sequence_63 = { 8bd8 8bf4 c70600000000 c7460400000000 }
            // n = 4, score = 100
            //   8bd8                 | je                  0xc
            //   8bf4                 | xor                 eax, eax
            //   c70600000000         | cmp                 byte ptr [eax], 0
            //   c7460400000000       | je                  0xc

        $sequence_64 = { 8bd8 c1eb08 23d1 8b149518d54600 23d9 33149d18d94600 8bd8 }
            // n = 7, score = 100
            //   8bd8                 | mov                 dword ptr [ebp - 4], 0
            //   c1eb08               | mov                 edx, dword ptr [ebp - 0x14]
            //   23d1                 | mov                 ebx, eax
            //   8b149518d54600       | mov                 dword ptr [ebp - 0x20], ebx
            //   23d9                 | mov                 dword ptr [ebp - 4], 0
            //   33149d18d94600       | mov                 edx, dword ptr [ebp - 0x14]
            //   8bd8                 | add                 edx, ebx

        $sequence_65 = { 8bd8 895de0 c745fc00000000 8b55ec }
            // n = 4, score = 100
            //   8bd8                 | add                 edx, edx
            //   895de0               | mov                 dword ptr [ecx + 0x10], esi
            //   c745fc00000000       | mov                 dword ptr [ecx + 4], eax
            //   8b55ec               | mov                 dword ptr [ecx], edx

        $sequence_66 = { 7436 0fbe0d???????? 33d2 416bc107 0f57c0 4103c3 }
            // n = 6, score = 100
            //   7436                 | inc                 ecx
            //   0fbe0d????????       |                     
            //   33d2                 | push                edi
            //   416bc107             | dec                 eax
            //   0f57c0               | lea                 ebp, [eax - 0x538]
            //   4103c3               | dec                 eax

        $sequence_67 = { 8bd8 895dd0 8b4de4 8d04cd00000000 2bc1 }
            // n = 5, score = 100
            //   8bd8                 | cmp                 byte ptr [eax], 0
            //   895dd0               | je                  0xc
            //   8b4de4               | cmp                 byte ptr [eax + 8], 0
            //   8d04cd00000000       | je                  0xc
            //   2bc1                 | xor                 eax, eax

        $sequence_68 = { 8bd8 c1ea10 c1eb08 23d1 8b149518d54600 }
            // n = 5, score = 100
            //   8bd8                 | test                edx, edx
            //   c1ea10               | jne                 0xb
            //   c1eb08               | xor                 eax, eax
            //   23d1                 | ret                 
            //   8b149518d54600       | leave               

        $sequence_69 = { 448d04bf 428d0441 41f7f1 413bc2 0f848c020000 0fbe05???????? 4983feff }
            // n = 7, score = 100
            //   448d04bf             | mov                 eax, edi
            //   428d0441             | xor                 edx, edx
            //   41f7f1               | dec                 eax
            //   413bc2               | mov                 ecx, eax
            //   0f848c020000         | dec                 esp
            //   0fbe05????????       |                     
            //   4983feff             | mov                 eax, edi

        $sequence_70 = { 0fbe0d???????? 03ca 7408 41b901000000 eb5a 0fbe05???????? }
            // n = 6, score = 100
            //   0fbe0d????????       |                     
            //   03ca                 | mov                 edx, eax
            //   7408                 | dec                 eax
            //   41b901000000         | mov                 ecx, edi
            //   eb5a                 | dec                 esp
            //   0fbe05????????       |                     

        $sequence_71 = { 0fbec8 0fafd1 8d14d2 e8???????? 0fbec0 }
            // n = 5, score = 100
            //   0fbec8               | sub                 esp, 0x5f8
            //   0fafd1               | inc                 ebp
            //   8d14d2               | mov                 eax, esi
            //   e8????????           |                     
            //   0fbec0               | dec                 eax

        $sequence_72 = { 03c2 33d2 f7f1 0fbe0d???????? 3bc1 0f8467030000 }
            // n = 6, score = 100
            //   03c2                 | xor                 edx, edx
            //   33d2                 | dec                 eax
            //   f7f1                 | mov                 ecx, eax
            //   0fbe0d????????       |                     
            //   3bc1                 | cmp                 eax, ecx
            //   0f8467030000         | je                  0x27a

    condition:
        7 of them and filesize < 4751360
}
[TLP:WHITE] win_vidar_w0   (20190106 | Yara rule for detecting Vidar stealer)
rule win_vidar_w0 {
    meta:
        description = "Yara rule for detecting Vidar stealer"
        author = "Fumik0_"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar"
        malpedia_version = "20190106"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $s1 = { 56 69 64 61 72 }
        $s2 = { 31 42 45 46 30 41 35 37 42 45 31 31 30 46 44 34 36 37 41 }
        
    condition:
        all of them
}
Download all Yara Rules