{"description": "Enterprise techniques used by Vidar, ATT&CK software S9050 (v1.0)", "name": "Vidar (S9050)", "domain": "enterprise-attack", "versions": {"layer": "4.5", "attack": "20", "navigator": "5.3.2"}, "techniques": [{"techniqueID": "T1548", "showSubtechniques": true}, {"techniqueID": "T1548.002", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has bypassed UAC by setting the Registry value `HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA` to `0`, which disabled UAC.(Citation: Logpoint_Stealer \nMalwareFamilies_2024)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1071", "showSubtechniques": true}, {"techniqueID": "T1071.001", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has used HTTP/HTTPS to retrieve and send data and beacons.(Citation: LevelBlue_Vidar_May2026)(Citation: CyberAus_Vidar_May2026)(Citation: Logpoint_StealerMalwareFamilies_2024)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1071.004", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has performed dynamic DNS resolution for gz[.]technicalprorj[.]xyz via 8.8.8[.]8.(Citation: LevelBlue_Vidar_May2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1560", "showSubtechniques": true}, {"techniqueID": "T1560.001", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has packaged collected data into a zip file before exfiltration.(Citation: Unit42_Vidar_July2026)(Citation: Logpoint_StealerMalwareFamilies_2024)(Citation: QuorumCyber_Vidar_March2023)\n", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1119", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has collected data using automated scripts within malicious executables.(Citation: QuorumCyber_Vidar_March2023)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1217", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has collected browser history from the victim machine.(Citation: QuorumCyber_Vidar_March2023)(Citation: Logpoint_StealerMalwareFamilies_2024)\n", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1059", "showSubtechniques": true}, {"techniqueID": "T1059.001", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has used PowerShell commands to modify Windows Defender\u2019s list of excluded file extensions.(Citation: Logpoint_StealerMalwareFamilies_2024)\n", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1543", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has created the RegAsm.exe process in a suspended state.(Citation: Cyfirma_Vidar_June2024)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1555", "showSubtechniques": true}, {"techniqueID": "T1555.003", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has gathered credentials and data, including history, credit cards and auto-filled information, from decrypted browser files from Chrome, Firefox, Edge, Opera, Vivaldi, Waterfox and Palemoon.(Citation: Intrinsec_Vidar_April2026)(Citation: LevelBlue_Vidar_May2026)(Citation: Unit42_Vidar_July2026)(Citation: Cyfirma_Vidar_June2024)(Citation: QuorumCyber_Vidar_March2023)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1005", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has attempted to collect browser information.(Citation: QuorumCyber_Vidar_March2023)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1074", "showSubtechniques": true}, {"techniqueID": "T1074.001", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has compiled collected data into a randomly generated directory in the ProgramData folder.(Citation: Cyfirma_Vidar_June2024)(Citation: Logpoint_StealerMalwareFamilies_2024)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1622", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has used the `IsDebuggerPresent` function to detect whether a debugger is present on a victim machine.(Citation: Cyfirma_Vidar_June2024)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1678", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has waited for six seconds using the command `timeout /t 6`.(Citation: Logpoint_StealerMalwareFamilies_2024)\n", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1140", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has used the function `CryptDecrypt`. Additionally, [Vidar](https://attack.mitre.org/software/S9050) has decoded the .data section using bitwise XOR operations.(Citation: Cyfirma_Vidar_June2024) [Vidar](https://attack.mitre.org/software/S9050) has decoded its core code after confirming debugger and/or analysis tools.(Citation: Cyfirma_Vidar_June2024)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1685", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has modified Windows Defender\u2019s list of excluded file extensions, ensuring that .exe, .dll and .bat files are ignored during scans.(Citation: Logpoint_StealerMalwareFamilies_2024) \n\n[Vidar](https://attack.mitre.org/software/S9050) has loaded amsi.dll, which resolves the `AmsiScanBuffer` variable to return `E_INVALIDARG`, which may disable Windows Antimalware Scan Interface (AMSI).(Citation: Unit42_Vidar_July2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1189", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has been distributed via malicious advertisements when users searched for \u201cNotepad++.\u201d(Citation: Logpoint_StealerMalwareFamilies_2024)\n", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1573", "showSubtechniques": true}, {"techniqueID": "T1573.002", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has used TLS 1.2 for C2 communication.(Citation: Cyfirma_Vidar_June2024)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1480", "comment": "If a debugger or analysis environment is detected, [Vidar](https://attack.mitre.org/software/S9050) has triggered a memory access violation exception, terminating its process by calling `RtlExitUserProcess`.(Citation: Cyfirma_Vidar_June2024)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1041", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has exfiltrated sensitive data, such as credentials and cryptocurrency wallets, over the C2 server at 136.243.203[.]109.(Citation: Unit42_Vidar_July2026) [Vidar](https://attack.mitre.org/software/S9050) has exfiltrated collected data through its C2 channel.(Citation: Cyfirma_Vidar_June2024)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1083", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has gathered information about files on the victim machine.(Citation: Unit42_Vidar_July2026) Specifically, [Vidar](https://attack.mitre.org/software/S9050) has used `FindFirstFileExW` and `FindNextFileW`.(Citation: Cyfirma_Vidar_June2024)(Citation: Logpoint_StealerMalwareFamilies_2024) [Vidar](https://attack.mitre.org/software/S9050) has attempted to read hidden system directories, such as `$Recycle.Bin`, `$Windows.~BT`, and `$SysReset`, and the `C:\\Windows\\System32\\config\\SOFTWARE` directory using the `ReadFile` function. [Vidar](https://attack.mitre.org/software/S9050) has also accessed internal streams, such as `$SDH`, and has read Jump Lists, which include recently opened files, programs and tasks.(Citation: Cyfirma_Vidar_June2024)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1222", "showSubtechniques": true}, {"techniqueID": "T1222.001", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has used `icacls` to modify file permissions.(Citation: QuorumCyber_Vidar_March2023)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1564", "showSubtechniques": true}, {"techniqueID": "T1564.001", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has used a hidden directory in the ProgramData directory to store collected data.(Citation: Logpoint_StealerMalwareFamilies_2024) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1574", "showSubtechniques": true}, {"techniqueID": "T1574.001", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has been executed as a file named msedge_elf.dll through sideloading.(Citation: Intrinsec_Vidar_April2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1070", "showSubtechniques": true}, {"techniqueID": "T1070.004", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has self-deleted its initial executable to operate in memory.(Citation: CyberAus_Vidar_May2026) [Vidar](https://attack.mitre.org/software/S9050) has deleted collected data after exfiltration.(Citation: Cyfirma_Vidar_June2024) [Vidar](https://attack.mitre.org/software/S9050) has also deleted the file Malware.exe and all .dll files in the ProgramData folder using the command `del /f /q \u201cC:\\Users\\MalWorkstation\\Desktop\\Malware.exe\u201d &\ndel C:\\ProgramData\\*.dll`.(Citation: Logpoint_StealerMalwareFamilies_2024)\n", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1105", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has downloaded additional binaries from the C2 server such as sqlx[1].dll, a sqlite3 binary for data harvesting and exfiltration.(Citation: Cyfirma_Vidar_June2024) [Vidar](https://attack.mitre.org/software/S9050) has also ownloaded get.zip, an archive containing several DLL libraries that extracted data from applications and browsers.(Citation: Logpoint_StealerMalwareFamilies_2024)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1036", "showSubtechniques": true}, {"techniqueID": "T1036.001", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has signed its DLL using fake certificates githab[.]com and grow[.]com.(Citation: Intrinsec_Vidar_April2026) [Vidar](https://attack.mitre.org/software/S9050) has also signed its files with an expired digital certificate.(Citation: QuorumCyber_Vidar_March2023)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1036.005", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has masqueraded as a Microsoft Edge DLL.(Citation: Intrinsec_Vidar_April2026) [Vidar](https://attack.mitre.org/software/S9050) has masqueraded as MicrosoftUpdate.exe in the %TEMP% folder.(Citation: Unit42_Vidar_July2026)(Citation: QuorumCyber_Vidar_March2023) [Vidar](https://attack.mitre.org/software/S9050) has masqueraded as a Notepad++ installer named npp.Installer.x64.zip.(Citation: Logpoint_StealerMalwareFamilies_2024) [Vidar](https://attack.mitre.org/software/S9050) has masqueraded as an executable named Setup.exe that mimics the legitimate Yahtzee application.(Citation: QuorumCyber_Vidar_March2023)\n", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1112", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has set the Registry value associated with User Access Control (UAC) (i.e. `HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA`) to `0`, which disabled UAC.(Citation: Logpoint_StealerMalwareFamilies_2024)\n", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1106", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has used native Windows functions, such as `LoadLibraryExW`, for discovery and execution.(Citation: Cyfirma_Vidar_June2024)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1027", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has also used control flow flattening to slow down static analysis.(Citation: Intrinsec_Vidar_April2026) ", "score": 1, "showSubtechniques": true}, {"techniqueID": "T1027.001", "comment": "An AES-encrypted version of [Vidar](https://attack.mitre.org/software/S9050) has been embedded into an inflated executable named Setup.exe, bypassing defensive tools.(Citation: QuorumCyber_Vidar_March2023)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1027.005", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has obfuscated stack strings within executable files.(Citation: QuorumCyber_Vidar_March2023)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1027.013", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has obfuscated and/or AES-encrypted its core code to avoid debugger and/or analysis tools.(Citation: Cyfirma_Vidar_June2024)(Citation: QuorumCyber_Vidar_March2023)\n\n[Vidar](https://attack.mitre.org/software/S9050) has used XOR to obfuscate the DLL name and the function name with key 0x05 to evade static string scanning.(Citation: Unit42_Vidar_July2026)(Citation: QuorumCyber_Vidar_March2023) \n\n[Vidar](https://attack.mitre.org/software/S9050) has Base64-encoded information relating to cryptocurrency wallet extensions.(Citation: Intrinsec_Vidar_April2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1566", "showSubtechniques": true}, {"techniqueID": "T1566.001", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has been distributed through emails that include malicious attachments, such as an ISO file, often masquerading as legitimate software, such as Adobe Photoshop or Microsoft Teams.(Citation: QuorumCyber_Vidar_March2023)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1566.002", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has been distributed through emails that include malicious links that redirect to fake download pages for Adobe Illustrator.(Citation: QuorumCyber_Vidar_March2023)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1057", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has used the functions `GetCurrentProcess` and `GetCurrentProcessId` to obtain information about processes.(Citation: Cyfirma_Vidar_June2024)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1055", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has injected itself into a legitimate Windows process.(Citation: QuorumCyber_Vidar_March2023)", "score": 1, "showSubtechniques": true}, {"techniqueID": "T1055.003", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has injected code into the suspended RegAsm.exe process.(Citation: Cyfirma_Vidar_June2024)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1055.012", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has used process hollowing to inject itself into an AppLaunch.exe process.(Citation: Logpoint_StealerMalwareFamilies_2024)\n", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1489", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has used the function `TerminateProcess` to terminate processes.(Citation: Cyfirma_Vidar_June2024)\n\n[Vidar](https://attack.mitre.org/software/S9050) has forcefully terminated a process named Devil.exe using the command `C:\\Windows\\System32\\cmd.exe\u201d /c taskkill /im Devil.exe /f`.(Citation: Logpoint_StealerMalwareFamilies_2024)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1129", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has loaded and executed common Windows DLLs during execution.(Citation: QuorumCyber_Vidar_March2023)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1539", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has extracted session cookies.(Citation: Intrinsec_Vidar_April2026)(Citation: LevelBlue_Vidar_May2026)  ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1082", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has gathered hardware IDs (HWIDs) regarding the victim machine.(Citation: Unit42_Vidar_July2026) [Vidar](https://attack.mitre.org/software/S9050) has used `GetEnvironmentStringsW` and `GetModuleHandleExW` to gather information about the victim machine.(Citation: Cyfirma_Vidar_June2024) [Vidar](https://attack.mitre.org/software/S9050) has collected OS data from the victim machine.(Citation: QuorumCyber_Vidar_March2023)(Citation: Logpoint_StealerMalwareFamilies_2024)\n", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1614", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has used the `EnumSystemLocalesW` function to enumerate installed or supported locales on the victim machine.(Citation: Cyfirma_Vidar_June2024) [Vidar](https://attack.mitre.org/software/S9050) has also used a GET request to ip-api[.]com, resolving the victim's public IP address and country.(Citation: Unit42_Vidar_July2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1016", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has collected the victim's public IP address.(Citation: Unit42_Vidar_July2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1569", "showSubtechniques": true}, {"techniqueID": "T1569.002", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has resumed the suspended process RegAsm.exe.(Citation: Cyfirma_Vidar_June2024)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1124", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has used the `GetSystemTimeAsFileTime` function to retrieve the current system date and time of the victim machine.(Citation: Cyfirma_Vidar_June2024)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1552", "showSubtechniques": true}, {"techniqueID": "T1552.001", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has collected credentials and cryptocurrency wallets stored internally.(Citation: Intrinsec_Vidar_April2026)(Citation: LevelBlue_Vidar_May2026)(Citation: Unit42_Vidar_July2026)(Citation: Cyfirma_Vidar_June2024)\n\n[Vidar](https://attack.mitre.org/software/S9050) has also decrypted local file stores, such as key4.db for Firefox, to find credentials.(Citation: Intrinsec_Vidar_April2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1204", "showSubtechniques": true}, {"techniqueID": "T1204.001", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has been distributed via a malicious link that redirects to a filesharing website.(Citation: Intrinsec_Vidar_April2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1204.004", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has used fake CAPTCHAs to deliver and execute itself to victims.(Citation: CyberAus_Vidar_May2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1497", "showSubtechniques": true}, {"techniqueID": "T1497.001", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has used \n`ZwQueryInformationProcess` to query process debug-related attributes, such as ProcessDebugPort and ProcessDebugFlags, and to query ProcessInstrumentationCallback (0x25) to evade analysis environments and monitoring tools.(Citation: LevelBlue_Vidar_May2026)(Citation: QuorumCyber_Vidar_March2023)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1497.003", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has used the `Sleep` API before C2 communication.(Citation: LevelBlue_Vidar_May2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1102", "showSubtechniques": true}, {"techniqueID": "T1102.001", "comment": "[Vidar](https://attack.mitre.org/software/S9050) has used Telegram and Steam dead drop resolvers to recover its C2 domain.(Citation: Intrinsec_Vidar_April2026)(Citation: LevelBlue_Vidar_May2026)(Citation: CyberAus_Vidar_May2026)(Citation: Cyfirma_Vidar_June2024)(Citation: Logpoint_StealerMalwareFamilies_2024)(Citation: QuorumCyber_Vidar_March2023)\n", "score": 1, "color": "#66b1ff", "showSubtechniques": true}], "gradient": {"colors": ["#ffffff", "#66b1ff"], "minValue": 0, "maxValue": 1}, "legendItems": [{"label": "used by Vidar", "color": "#66b1ff"}]}