Vidar Virtual Machine-Based String Obfuscation | ThreatLabz
Vidar stealer added per-build virtual machine bytecode interpreter and custom stream cipher string obfuscation across versions 2.0–3.3, hindering static analysis. The VM uses a 256-entry dispatch table with 14 opcode handlers to deobfuscate strings or decrypt 8-byte keys and 4-byte nonces for a second-layer custom ARX stream cipher. Opcodes, constants, substitution tables, and ARX operations change per build. Samples exhibit anti-analysis behaviors including RDTSC-based VM detection, debugger thread hiding, and direct IP HTTPS connections without DNS.
Detection / Hunteropenrouter
Immediate Actions
- Block the four listed SHA256 hashes on endpoints and email gateways.
- Hunt for direct IP HTTPS connections from endpoints without prior DNS resolution.
- Quarantine and investigate processes matching Zscaler MDR stealer detection analytics.
- Search for web browser processes with unusual parent process ancestry.
Key Takeaways
- Evolution: XOR (pre-v1.5) → ChaCha20 (v1.5) → modified ChaCha20 (v1.8) → VM + custom cipher (v2.0).
- VM uses 4-byte hardcoded XOR key as accumulator seed; key changes per build.
- ARX stream cipher initializes state with FNV-1a prime (0x01000193) and golden ratio constant (0x9E3779B9).
- Sandboxed sample (MD5 9C3AE73AFF8475BA1BED8303FCD07DF8) is Go-compiled PE64 with non-standard section names.
- Zscaler MDR analytics: Telegram shortened URL connections, unusual browser parent process, stealer file modifications.
Attack Chain
- Initial Access: Vidar PE64 executable (likely Go-compiled) delivered to Windows endpoints
- Anti-Analysis: RDTSC timing checks detect VMs; threads hidden from debuggers; error messages disabled
- Deobfuscation: Bytecode interpreter VM with per-build opcodes decrypts strings at runtime
- Secondary Decryption: VM outputs key/nonce for ARX stream cipher to decrypt remaining strings
- Collection/Exfiltration: Steals browser, wallet, plugin data; exfiltrates via direct HTTPS to IPs
Affected Systems
- Windows systems targeted by Vidar stealer
- Browsers, cryptocurrency wallets, browser plugins
- Endpoints receiving Vidar versions 2.0–3.4
Detection Availability
- Published: Other detection logic
- Platforms: Zscaler MDR, Zscaler Cloud Sandbox
Zscaler MDR detection analytics and Cloud Sandbox detection named; no rule bodies published.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can observe process behaviors, anti-analysis checks, and network connections, but not VM bytecode content. |
| Network Visibility | Medium | Direct IP HTTPS connections without DNS lookups are visible; payloads are encrypted. |
| Detection Difficulty | Hard | Per-build opcode, constant, and ARX operation changes defeat static signatures; behavioral detection required. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Processes making direct HTTPS connections to IP addresses without prior DNS resolution (T1071.001) | Network connection and DNS query event logs | Command and Control | Medium — legitimate tools may use direct IPs sometimes |
| Process performing RDTSC-based timing measurements to detect virtualization or sandbox environments (T1497.001) | EDR API monitoring and behavioral telemetry logs | Defense Evasion | Low — RDTSC in non-system processes is suspicious |
| File modifications to browser credential stores or cryptocurrency wallet data by non-browser processes (T1005) | File access and modification events from EDR | Collection | Medium — legitimate security tools may access wallet files |
Required Log Sources
- Process creation and parent-child telemetry (Sysmon EID 1)
- Network connections (Sysmon EID 3)
- DNS queries (Sysmon EID 22)
- File modifications (Sysmon EID 2, 11)
- Thread creation and handle events (Sysmon EID 8, 10)
- EDR behavioral and API monitoring alerts
Key Behavioral Indicators
- Direct HTTPS connections to IP addresses without prior DNS resolution
- Web browser process with unusual parent process ancestry
- RDTSC timing checks in non-system PE executables
- PE64 with non-standard section names and Go compilation artifacts
- Threads hidden from debugger inspection
- Application error reporting disabled programmatically
Control Gaps
- Static AV signatures cannot track per-build opcode and constant changes
- DNS-based blocking misses direct IP HTTPS connections without DNS lookups
- Sandbox analysis evaded by RDTSC-based virtualization timing detection
- String-based YARA rules ineffective against VM-deobfuscated strings
- TLS encryption prevents payload inspection of stealer C2 traffic
False Positive Assessment
Low — behavioral indicators like direct IP connections and unusual browser parents are specific to stealer activity.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Enforce DNS resolution for outbound HTTPS; alert on direct IP connections.
- Deploy TLS inspection to detect stealer C2 traffic patterns.
- Enable EDR behavioral detection for anti-analysis and sandbox evasion techniques.
User Protection
- Deploy endpoint detection with behavioral stealer detection beyond static signatures.
- Monitor browser credential store and cryptocurrency wallet file access patterns.
- Restrict execution of unknown PE64 executables, especially Go-compiled binaries.
Security Awareness
- Warn users about running unknown executables that target browser and wallet data.
MITRE ATT&CK Mapping
Stealth
Collection
Command and Control
Exfiltration
Plain-Language Summary
Vidar, a malware that steals information from computers, added new ways to hide its internal text from security tools. Starting with version 2.0, it uses a small custom program (a virtual machine) whose instructions change with every new version, making it hard for antivirus software to detect. The malware also checks whether it is running in a security lab and hides from debugging tools. Organizations should update their detection systems to keep pace with these changes.
Additional IOCs
- File Hashes:
9C3AE73AFF8475BA1BED8303FCD07DF8(MD5) - Vidar sample analyzed in Zscaler Cloud Sandbox
- md59c3ae73aff8475ba1bed8303fcd07df8Vidar sample analyzed in Zscaler Cloud Sandbox
- sha2561628bb03db87f67661349e169d73ee14ed490bdbf22abfbda08ccc9ebe237974Vidar v2.0 sample with VM and modified ChaCha cipher
- sha2562d43d592630ad1e012da63ef7279f95dd4a8e94964e12ca2f996051875574fa6Vidar v3.1 sample with VM and custom ARX cipher
- sha256625a381981fc2d4c25c981d98b1d66bb2cf5da2dde2f590add0673a857d5b074Vidar v2.5 sample with ARX stream cipher implementation
- sha256979048a749d8f28d877c7068b1b336ecd1e349869dfb1d7c68118f90e4099bc4Vidar v3.4 latest sample with updated obfuscation