# Vidar Infostealer Adds Custom VM and Per-Build Stream Ciphers for String Obfuscation

> Zscaler ThreatLabz documents the evolution of Vidar infostealer string obfuscation across internal versions 2.0 to 3.3, from single-byte XOR and ChaCha20 variants to a per-build custom bytecode VM (14 handlers, 256-entry dispatch table) paired with per-build custom stream ciphers. The per-build variation is designed to hinder static and automated analysis.

- **Published:** 2026-11-09T17:42:15Z
- **Last reviewed:** 2026-11-09T17:42:15Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5572
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5572.png
- **ID:** TL-2026-5572
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 10 (3 shown free below)

## Description

Vidar is a commodity infostealer first observed in 2018 (reported by Acronis TRU as a fork of Arkei). Zscaler ThreatLabz (analysis of samples from May to early September 2026, published 2026-09-21) tracks how the family's string obfuscation has changed. Early builds used single-byte XOR. Internal v1.5 adopted ChaCha20 and v1.8 modified it with different quarter-round rotations. Internal v2.0 introduced two per-build features: a custom virtual machine and a custom stream cipher. Zscaler first observed the VM in June 2026.

The VM is a fetch-decode-execute bytecode interpreter with a sparse 256-entry dispatch table in which unused slots are null and terminate execution. It has 14 populated opcode handlers, no stack, and a single one-byte accumulator. Its primitives are XOR, addition, subtraction, rotation, bitwise NOT, multiplication and S-box substitution. Opcodes, constants and substitution tables vary per build. A hardcoded 4-byte XOR key also seeds the accumulator. The VM decodes some strings directly and also decrypts the key and nonce for the stream cipher: in v2.0 and v2.1 the first 9 bytes are the key, from v2.2 the first 8 bytes are the key, and in all versions the last 4 bytes are the nonce.

Two stream cipher families are described. v2.0 and v2.1 use a modified ChaCha with a custom 128-bit initial state, an 8-byte key, a 4-byte nonce and varying quarter-round rotations. v2.2 and later use an ARX design: the key is absorbed with FNV-1a multiplication using a per-build seed constant, the nonce is absorbed with the constant 0x9E3779B9, and each keystream byte comes from add-rotate-XOR steps with per-build constants, folded to one byte and XORed with the ciphertext. Decoded strings include loader status messages (for example 'Loader: write failed'), browser/wallet/plugin counters from a 'grabber' component, an HWID error message and an HTTP Accept header string.

The Zscaler post does not describe C2, delivery or data theft in detail. Other vendor reporting (Acronis TRU) describes Vidar 2.0 (released 2025-10-06) as using dead drop resolvers on Mastodon, Telegram and Steam profiles that encode the current C2 IP, exfiltrating via HTTP POST with empty User-Agent and Host headers and URI '/', stealing browser credentials, cookies, 2FA tokens and crypto wallets, and being delivered through malvertising, GitHub release abuse, ClickFix/FileFix lures and fake game cheats. Note that Zscaler's internal version numbering may not map one-to-one to other vendors' labels. The Zscaler text names v3.3 as the latest, but its IOC table lists a v3.4 sample. Severity is analyst-assigned because the source gives none. No CVE, CVSS or actor attribution is stated.

## MITRE ATT&CK

- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1027.001 Obfuscated Files or Information: Binary Padding
- T1055 Process Injection
- T1070.004 Indicator Removal: File Deletion
- T1497 Virtualization/Sandbox Evasion
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1082 System Information Discovery
- T1102.001 Web Service: Dead Drop Resolver
- T1071.001 Application Layer Protocol: Web Protocols
- T1204.004 User Execution: Malicious Copy and Paste

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Vidar ClickFix - Explorer-Spawned Shell With Download Cradle (T1204.004)** (`TL-2026-5572-SPL-001`)

Detects powershell, pwsh, mshta or cmd launched directly by explorer.exe with a download-and-execute or encoded command line. This is the Run-dialog paste pattern used by ClickFix lures that deliver the Vidar infostealer (TL-2026-5572, T1204.004). The behaviour is independent of Vidar's per-build string obfuscation, so it survives rebuilds.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.004, T1059.001
- **Data sources:** sysmon (index=sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode 1), microsoft_defender_for_endpoint DeviceProcessEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\explorer.exe" (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\mshta.exe" OR Image="*\\cmd.exe")
| where match(CommandLine, "(?i)(invoke-expression|downloadstring|invoke-webrequest|(^|[\s;&|])iex\s|(^|\s)iwr\s|mshta(\.exe)?\s+https?://|curl(\.exe)?\s.*https?://|-enc(odedcommand)?\s)")
| stats count min(_time) as firstTime max(_time) as lastTime values(CommandLine) as commandlines by Computer User ParentImage Image
| convert ctime(firstTime) ctime(lastTime)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe", "mshta.exe", "cmd.exe")
| where ProcessCommandLine matches regex @"(?i)(invoke-expression|downloadstring|invoke-webrequest|(^|[\s;&|])iex\s|(^|\s)iwr\s|mshta(\.exe)?\s+https?://|curl(\.exe)?\s.*https?://|-enc(odedcommand)?\s)"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: Vidar ClickFix - Explorer-Spawned Shell With Download Cradle
id: 7c1e5a42-3b8d-4f1a-9a6e-2d4b8c0f1e11
status: experimental
description: Detects a shell or mshta process launched directly by explorer.exe (Win+R Run dialog paste, ClickFix lure) with a download-and-execute command line, a documented Vidar infostealer delivery path (T1204.004). TL-2026-5572.
references:
    - https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation
    - https://www.acronis.com/en/tru/threat-catalog/malware/infostealers/vidar/
author: Threadlinqs Team
date: 2026-11-09
tags:
    - attack.execution
    - attack.t1204.004
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\explorer.exe'
    selection_image:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\mshta.exe'
            - '\cmd.exe'
    selection_cli:
        CommandLine|contains:
            - 'Invoke-Expression'
            - 'iex '
            - 'iex('
            - 'DownloadString'
            - 'Invoke-WebRequest'
            - 'iwr '
            - 'mshta http'
            - 'curl '
            - '-EncodedCommand'
            - ' -enc '
    condition: all of selection_*
falsepositives:
    - Administrators or users launching legitimate PowerShell one-liners from Explorer shortcuts
    - Software installers or bootstrap scripts started from Explorer
level: high

```

**Known false positives:**

- Administrators or users launching legitimate PowerShell one-liners from Explorer shortcuts
- Software installers or bootstrap scripts started from Explorer that use Invoke-WebRequest or curl

**Tuning notes:** Allow-list known internal script hosts and signed installers by CommandLine or URL domain. Require an external URL in the command line to lower noise. Pair with the RunMRU detection (TL-2026-5572-KQL-001) to confirm Run-dialog origin.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Vidar ClickFix - Suspicious Command Typed Into Run Dialog (RunMRU) (locked: unlock with TL Creds)
- Vidar - Remote Thread Injection Into Browser From User-Writable Path (locked: unlock with TL Creds)
- Vidar - HTTP POST to Root URI With Empty User-Agent (Exfiltration) (locked: unlock with TL Creds)
- Vidar Infostealer - Known Zscaler-Reported Sample Hashes (v2.0-v3.4) (locked: unlock with TL Creds)
- Vidar - Browser Credential and Cookie Store Read by Non-Browser Process (locked: unlock with TL Creds)
- Vidar-Related Community-Observed Infrastructure - DNS Lookup (locked: unlock with TL Creds)
- Vidar - Chromium Browser Launched in Debug Mode by Non-Browser Process (locked: unlock with TL Creds)
- Vidar - Dead Drop Resolver Lookup by Non-Browser Process (Telegram, Steam, Mastodon) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 10)

Defanged, TLP:CLEAR.

- Domain: `ieji[.]de`
- File hash: `1628bb03db87f67661349e169d73ee14ed490bdbf22abfbda08ccc9ebe237974`
- Domain: `koyu[.]space`

Full set of 10 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Vidar Adds Virtual Machine and Custom Stream Ciphers For String Obfuscation (Zscaler ThreatLabz)](https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation)
- [Zscaler ThreatLabz Threat Library: Win32.PWS.Vidar](https://threatlabz.zscaler.com/threat-library/58bdf914-aa86-43f8-9469-d1e7efb94b00)
- [Vidar Stealer threat catalog (Acronis TRU)](https://www.acronis.com/en/tru/threat-catalog/malware/infostealers/vidar/)
- [TLP:CLEAR New Vidar (Intrinsec)](https://www.intrinsec.com/wp-content/uploads/2026/04/TLP_CLEAR-20260424-New_Vidar.pdf)
- [Infostealer Malware Vidar distributed via the Steam store (SECUINFRA)](https://www.secuinfra.com/en/techtalk/infostealer-malware-vidar-spread-via-the-steam-store/)
- [Vidar Malware: How the Multithreaded Windows Stealer Works (Picus Security)](https://www.picussecurity.com/resource/blog/vidar-malware-how-the-multithreaded-windows-stealer-works)
- [Vidar Stealer 2.0 distributed via fake game cheats on GitHub and Reddit (Hive Pro)](https://hivepro.com/threat-advisory/vidar-stealer-2-0-distributed-via-fake-game-cheats-on-github-and-reddit)
- [Vidar distributed through backdoored Windows 11 downloads and abusing Telegram (Zscaler, via Security Boulevard)](https://securityboulevard.com/2022/05/vidar-distributed-through-backdoored-windows-11-downloads-and-abusing-telegram)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5572