Vidar first surfaced in late 2018. It descends from the same code lineage as Arkei and Oski and is sold as malware-as-a-service. Distribution is usually spam with a downloader document, or cracked software and key generators.
Start-up behaviour
- A locale check reads the user's language configuration and exits for several post-Soviet locales (Russia, Belarus, Uzbekistan, Kazakhstan, Azerbaijan).
- A mutex is built from the hardware profile identifier combined with the machine GUID, so every victim gets a different name.
- The command-and-control domain is stored XOR-encoded and decoded at run time.
- It downloads a configuration plus several helper libraries.
freebl3.dll mozglue.dll msvcp140.dll
nss3.dll softokn3.dll vcruntime140.dll
These are genuine browser support libraries, brought along so that Firefox-family credential stores can be decrypted without relying on the victim's installation.
Collection targets
browsers : Chrome, Edge, Firefox, Opera, Vivaldi, Tor Browser and dozens of forks
messengers : Telegram, Pidgin, Thunderbird, Bat!
wallets : Bitcoin, Ethereum, Litecoin, Zcash, Exodus, Electrum variants, others
ftp : FileZilla, WinSCP
2FA : the local database of an authenticator desktop app
extras : screenshot, document search by pattern, machine info file
The machine information file records the Vidar version, date, hardware and machine IDs, working paths, hostname, user, language, keyboard layout, time zone, CPU count, memory size and video card.
Exit
After the data is zipped and sent, Vidar kills its own process and deletes the file from the temp folder in one command line, so the disk keeps almost nothing.
cmd.exe /c taskkill /im vidar.exe /f & erase %TEMP%\vidar.exe & exit
Hunting ideas
- Support DLLs written to a temp folder together and then removed within seconds.
- A process that enumerates dozens of browser profile paths in sequence.
- Self-deletion through cmd after network upload.