Vidar Stealer Used Obfuscated Strings and Selective Exfiltration for Sensitive Targets
Malware Intelligence · 3 sources · Updated 2mo ago · First seen Dec 5, 2023
Researchers analyzing multiple Vidar Stealer samples found the malware relies heavily on encrypted or XOR-obfuscated strings and dynamic API resolution to conceal its behavior. Reverse engineering with Ghidra and x32dbg exposed decrypted strings tied to LoadLibraryA, GetProcAddress, VirtualAlloc, anti-analysis checks, and broad data-theft functions. The recovered functionality shows Vidar harvesting browser passwords, cookies, autofill data, credit cards, Firefox/NSS secrets, FileZilla and WinSCP data, Steam files, Discord and Telegram artifacts, screenshots, host metadata, and numerous desktop and browser-extension cryptocurrency wallets.
A separate campaign analysis showed Vidar configured to treat some stolen data differently when credentials were associated with hostnames linked to government, military, police, intelligence, CERT, and NATO-related organizations in Poland and the Baltic region. In that sample, the malware decrypted a hardcoded hostname list, checked stolen credentials for matches, and redirected matching data to an alternate command-and-control path, while command-and-control addresses were retrieved from Mastodon profiles including @oleg98 and @artemida. The reporting also linked the broader activity to infrastructure or samples associated with Raccoon, RedLine Stealer, SmokeLoader, and STOP ransomware, indicating a wider criminal ecosystem around the campaign.
