Vidar Malware: How the Multithreaded Windows Stealer Works

Malware News
1

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

Vidar Malware: How the Multithreaded Windows Stealer Works

Key Takeaways

  • Vidar is a Windows information stealer sold as malware-as-a-service.
  • Vidar’s new version rewrites the malware in pure C with a multithreaded engine that scales to victim hardware.
  • Vidar bypasses Chrome App-Bound Encryption by scanning forked browser memory and injecting an APC to decrypt the master key.
  • Stolen data exfiltrates over HTTP multipart POST to round-robin C2 using Telegram and Steam profiles as dead drops.
  • The Picus Platform lets teams simulate Vidar infostealer attacks and validate security controls against this threat.

Vidar is a Windows information stealer that was first observed in 2018 on Russian-language underground forums, where it emerged as a fork of the Arkei stealer source code.

Article Link: Vidar Malware: How the Multithreaded Windows Stealer Works