1. Home
  2. Software
  3. Vidar

Vidar

Vidar is a Windows infostealer that was first advertised in November 2018. Written in C++, Vidar collects PII, cryptocurrency wallets, documents and other data within the compromised machine. Version 2 of Vidar was published in October 2025, and has been used in numerous operations since its release. Vidar has been observed alongside other malware strains, including STOP/Djvu ransomware, Mina.exe (an XMRIG miner), and Clip1.exe (a Laplas Clipper sample).[1][2][3][4][5][6][7][8]

ID: S9050
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Contributors: Jeremy Ang
Version: 1.0
Created: 11 September 2026
Last Modified: 23 September 2026
Version Permalink
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1548 .002 Abuse Elevation Control Mechanism: Bypass User Account Control

Vidar has bypassed UAC by setting the Registry value HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA to 0, which disabled UAC.(Citation: Logpoint_Stealer
MalwareFamilies_2024)
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

Vidar has used HTTP/HTTPS to retrieve and send data and beacons.[2][3][6]
.004 Application Layer Protocol: DNS

Vidar has performed dynamic DNS resolution for gz[.]technicalprorj[.]xyz via 8.8.8[.]8.[2]

Enterprise T1560 .001 Archive Collected Data: Archive via Utility

Vidar has packaged collected data into a zip file before exfiltration.[4][6][8]
Enterprise T1119 Automated Collection

Vidar has collected data using automated scripts within malicious executables.[8]
Enterprise T1217 Browser Information Discovery

Vidar has collected browser history from the victim machine.[8][6]
Enterprise T1059 .001 Command and Scripting Interpreter: PowerShell

Vidar has used PowerShell commands to modify Windows Defender’s list of excluded file extensions.[6]
Enterprise T1543 Create or Modify System Process

Vidar has created the RegAsm.exe process in a suspended state.[5]
Enterprise T1555 .003 Credentials from Password Stores: Credentials from Web Browsers

Vidar has gathered credentials and data, including history, credit cards and auto-filled information, from decrypted browser files from Chrome, Firefox, Edge, Opera, Vivaldi, Waterfox and Palemoon.[1][2][4][5][8]
Enterprise T1005 Data from Local System

Vidar has attempted to collect browser information.[8]
Enterprise T1074 .001 Data Staged: Local Data Staging

Vidar has compiled collected data into a randomly generated directory in the ProgramData folder.[5][6]
Enterprise T1622 Debugger Evasion

Vidar has used the IsDebuggerPresent function to detect whether a debugger is present on a victim machine.[5]
Enterprise T1678 Delay Execution

Vidar has waited for six seconds using the command timeout /t 6.[6]
Enterprise T1140 Deobfuscate/Decode Files or Information

Vidar has used the function CryptDecrypt. Additionally, Vidar has decoded the .data section using bitwise XOR operations.[5] Vidar has decoded its core code after confirming debugger and/or analysis tools.[5]
Enterprise T1685 Disable or Modify Tools

Vidar has modified Windows Defender’s list of excluded file extensions, ensuring that .exe, .dll and .bat files are ignored during scans.[6]

Vidar has loaded amsi.dll, which resolves the AmsiScanBuffer variable to return E_INVALIDARG, which may disable Windows Antimalware Scan Interface (AMSI).[4]
Enterprise T1189 Drive-by Compromise

Vidar has been distributed via malicious advertisements when users searched for "Notepad++."[6]
Enterprise T1573 .002 Encrypted Channel: Asymmetric Cryptography

Vidar has used TLS 1.2 for C2 communication.[5]
Enterprise T1480 Execution Guardrails

If a debugger or analysis environment is detected, Vidar has triggered a memory access violation exception, terminating its process by calling RtlExitUserProcess.[5]
Enterprise T1041 Exfiltration Over C2 Channel

Vidar has exfiltrated sensitive data, such as credentials and cryptocurrency wallets, over the C2 server at 136.243.203[.]109.[4] Vidar has exfiltrated collected data through its C2 channel.[5]
Enterprise T1083 File and Directory Discovery

Vidar has gathered information about files on the victim machine.[4] Specifically, Vidar has used FindFirstFileExW and FindNextFileW.[5][6] Vidar has attempted to read hidden system directories, such as $Recycle.Bin, $Windows.~BT, and $SysReset, and the C:\Windows\System32\config\SOFTWARE directory using the ReadFile function. Vidar has also accessed internal streams, such as $SDH, and has read Jump Lists, which include recently opened files, programs and tasks.[5]
Enterprise T1222 .001 File and Directory Permissions Modification: Windows Permissions

Vidar has used icacls to modify file permissions.[8]
Enterprise T1564 .001 Hide Artifacts: Hidden Files and Directories

Vidar has used a hidden directory in the ProgramData directory to store collected data.[6]

Enterprise T1574 .001 Hijack Execution Flow: DLL

Vidar has been executed as a file named msedge_elf.dll through sideloading.[1]

Enterprise T1070 .004 Indicator Removal: File Deletion

Vidar has self-deleted its initial executable to operate in memory.[3] Vidar has deleted collected data after exfiltration.[5] Vidar has also deleted the file Malware.exe and all .dll files in the ProgramData folder using the command del /f /q "C:\Users\MalWorkstation\Desktop\Malware.exe" &del C:\ProgramData\*.dll.[6]
Enterprise T1105 Ingress Tool Transfer

Vidar has downloaded additional binaries from the C2 server such as sqlx[1].dll, a sqlite3 binary for data harvesting and exfiltration.[5] Vidar has also ownloaded get.zip, an archive containing several DLL libraries that extracted data from applications and browsers.[6]
Enterprise T1036 .001 Masquerading: Invalid Code Signature

Vidar has signed its DLL using fake certificates githab[.]com and grow[.]com.[1] Vidar has also signed its files with an expired digital certificate.[8]
.005 Masquerading: Match Legitimate Resource Name or Location

Vidar has masqueraded as a Microsoft Edge DLL.[1] Vidar has masqueraded as MicrosoftUpdate.exe in the %TEMP% folder.[4][8] Vidar has masqueraded as a Notepad++ installer named npp.Installer.x64.zip.[6] Vidar has masqueraded as an executable named Setup.exe that mimics the legitimate Yahtzee application.[8]
Enterprise T1112 Modify Registry

Vidar has set the Registry value associated with User Access Control (UAC) (i.e. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA) to 0, which disabled UAC.[6]
Enterprise T1106 Native API

Vidar has used native Windows functions, such as LoadLibraryExW, for discovery and execution.[5]
Enterprise T1027 Obfuscated Files or Information

Vidar has also used control flow flattening to slow down static analysis.[1]

.001 Binary Padding

An AES-encrypted version of Vidar has been embedded into an inflated executable named Setup.exe, bypassing defensive tools.[8]
.005 Indicator Removal from Tools

Vidar has obfuscated stack strings within executable files.[8]
.013 Encrypted/Encoded File

Vidar has obfuscated and/or AES-encrypted its core code to avoid debugger and/or analysis tools.[5][8]

Vidar has used XOR to obfuscate the DLL name and the function name with key 0x05 to evade static string scanning.[4][8]

Vidar has Base64-encoded information relating to cryptocurrency wallet extensions.[1]

Enterprise T1566 .001 Phishing: Spearphishing Attachment

Vidar has been distributed through emails that include malicious attachments, such as an ISO file, often masquerading as legitimate software, such as Adobe Photoshop or Microsoft Teams.[8]
.002 Phishing: Spearphishing Link

Vidar has been distributed through emails that include malicious links that redirect to fake download pages for Adobe Illustrator.[8]
Enterprise T1057 Process Discovery

Vidar has used the functions GetCurrentProcess and GetCurrentProcessId to obtain information about processes.[5]
Enterprise T1055 Process Injection

Vidar has injected itself into a legitimate Windows process.[8]
.003 Thread Execution Hijacking

Vidar has injected code into the suspended RegAsm.exe process.[5]
.012 Process Hollowing

Vidar has used process hollowing to inject itself into an AppLaunch.exe process.[6]
Enterprise T1489 Service Stop

Vidar has used the function TerminateProcess to terminate processes.[5]

Vidar has forcefully terminated a process named Devil.exe using the command C:\Windows\System32\cmd.exe" /c taskkill /im Devil.exe /f.[6]
Enterprise T1129 Shared Modules

Vidar has loaded and executed common Windows DLLs during execution.[8]
Enterprise T1539 Steal Web Session Cookie

Vidar has extracted session cookies.[1][2]

Enterprise T1082 System Information Discovery

Vidar has gathered hardware IDs (HWIDs) regarding the victim machine.[4] Vidar has used GetEnvironmentStringsW and GetModuleHandleExW to gather information about the victim machine.[5] Vidar has collected OS data from the victim machine.[8][6]
Enterprise T1614 System Location Discovery

Vidar has used the EnumSystemLocalesW function to enumerate installed or supported locales on the victim machine.[5] Vidar has also used a GET request to ip-api[.]com, resolving the victim's public IP address and country.[4]
Enterprise T1016 System Network Configuration Discovery

Vidar has collected the victim's public IP address.[4]
Enterprise T1569 .002 System Services: Service Execution

Vidar has resumed the suspended process RegAsm.exe.[5]
Enterprise T1124 System Time Discovery

Vidar has used the GetSystemTimeAsFileTime function to retrieve the current system date and time of the victim machine.[5]
Enterprise T1552 .001 Unsecured Credentials: Credentials In Files

Vidar has collected credentials and cryptocurrency wallets stored internally.[1][2][4][5]

Vidar has also decrypted local file stores, such as key4.db for Firefox, to find credentials.[1]
Enterprise T1204 .001 User Execution: Malicious Link

Vidar has been distributed via a malicious link that redirects to a filesharing website.[1]
.004 User Execution: Malicious Copy and Paste

Vidar has used fake CAPTCHAs to deliver and execute itself to victims.[3]
Enterprise T1497 .001 Virtualization/Sandbox Evasion: System Checks

Vidar has used
ZwQueryInformationProcess to query process debug-related attributes, such as ProcessDebugPort and ProcessDebugFlags, and to query ProcessInstrumentationCallback (0x25) to evade analysis environments and monitoring tools.[2][8]
.003 Virtualization/Sandbox Evasion: Time Based Checks

Vidar has used the Sleep API before C2 communication.[2]
Enterprise T1102 .001 Web Service: Dead Drop Resolver

Vidar has used Telegram and Steam dead drop resolvers to recover its C2 domain.[1][2][3][5][6][8]

Groups That Use This Software

ID Name References
G1015 Scattered Spider

[7]

References

  1. Intrinsec. (2026, April). "Chaos is a ladder": Vidar's recent rise to the top. Retrieved April 27, 2026.
  2. Joshi, M. (2026, May 7). Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer Command-and-Control Communication. Retrieved May 8, 2026.
  3. Australian Signals Directorate’s Australian Cyber Security Centre. (2026, May 7). ClickFix distributing Vidar Stealer via WordPress targeting Australian infrastructure. Retrieved May 8, 2026.
  4. Nannaka, B., Chhaparwal, P. (2026, July 7). Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation. Retrieved July 8, 2026.
  1. CYFIRMA. (2024, June 3). Vidar Stealer: An In-depth Analysis of an Information-Stealing Malware. Retrieved August 13, 2026.
  2. Khadgi, N. (n.d.). A Comprehensive Overview on Stealer Malware Families. Retrieved August 25, 2026.
  3. CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.
  4. Quorum Cyber. (n.d.). Malware Analysis Report Vidar - Stealerware. Retrieved August 28, 2026.