THE Vidar information stealer has adopted a custom virtual machine and changing stream-cipher encryption to make its code harder to analyse, according to Zscaler ThreatLabz. The malware is reportedly spread through deceptive software cracks, game modifications and other malicious downloads hosted on compromised websites or forums, targeting general users and corporate networks.
From internal version 2.0, Vidar uses a bytecode interpreter with a sparse 256-entry dispatch table and 14 key handlers to decode concealed data. Versions 2.0 and 2.1 use the first nine bytes as a key, while newer releases use the first eight; the final four bytes provide the nonce. Versions 2.2 and later use an add-rotate-XOR stream cipher. A four-byte XOR key, changed for each build, also seeds the interpreter’s accumulator. This follows earlier single-byte XOR protection, ChaCha20 from version 1.5 and a modified ChaCha20 implementation from version 1.8.
The stealer searches for browser passwords, cryptocurrency wallet files, session cookies, Telegram and Discord data, autofill information and hardware details. It sends compressed archives to attacker-controlled infrastructure, with command-and-control destinations reportedly concealed until runtime. ThreatLabz recommends behavioural detection rather than relying solely on static signatures, including monitoring processes accessing browser credential stores and unexpected network connections. The report also advises using endpoint detection capable of analysing execution behaviour and warning users about pirated software.