Zscaler ThreatLabz tracked Vidar’s string obfuscation as it evolved from XOR and ChaCha20 into a per-build virtual machine and custom stream cipher designed to frustrate static analysis. The report details how these changes affect deobfuscation, shows example VM opcodes and ARX/ChaCha-based cipher logic, and includes Zscaler detections for Vidar. #Vidar #Zscaler #ThreatLabz
Keypoints
- Vidar is an information stealer first observed in 2018.
- Its string obfuscation evolved from single-byte XOR to ChaCha20-based encryption and later to a custom virtual machine plus a custom stream cipher.
- ThreatLabz observed the VM-based obfuscation emerge in internal versions 2.x and 3.x, with opcodes, constants, and tables changing per build.
- Vidar uses the VM both to directly deobfuscate strings and to decrypt a key/nonce pair used by the stream cipher.
- The custom stream cipher has two broad forms: a modified ChaCha-based cipher in versions 2.0–2.1 and an ARX-based cipher in version 2.2 and later.
- Per-build randomization of opcodes, constants, and micro-operations is intended to hinder automated and static analysis.
- Zscaler reports detections for Vidar through sandboxing and MDR analytics, including the threat name Win32.PWS.Vidar.
MITRE Techniques
- [T1027 ] Obfuscated Files or Information – Vidar hides strings and decryption logic with XOR, ChaCha20, a custom VM, and changing constants to make analysis harder (‘string obfuscation’, ‘change deobfuscation algorithms, constants, and primitives’).
- [T1027.013 ] Encrypted/Encoded File – Information – The malware stores strings in encrypted or encoded form and decrypts them at runtime using VM output and custom ciphers (‘obfuscate strings’, ‘decrypt an additional byte array containing the actual encrypted string’).
- [T1140 ] Deobfuscate/Decode Files or Information – The VM interpreter and custom stream cipher are used to recover readable strings during execution (‘interpreted to create the final deobfuscated string’, ‘decrypt some of the malware’s strings’).
- [T1055 ] Process Injection – No technique explicitly mentioned in the article. However, this is not supported by the provided text and should not be inferred.
Indicators of Compromise
- [SHA-256 hashes ] Vidar sample IOCs linked to versions v2.0, v2.5, v3.1, and v3.4 – 1628bb03db87f67661349e169d73ee14ed490bdbf22abfbda08ccc9ebe237974, 625a381981fc2d4c25c981d98b1d66bb2cf5da2dde2f590add0673a857d5b074, and 2 more hashes
- [Threat names ] Zscaler detections for the family – Win32.PWS.Vidar
- [Detection analytics names ] MDR analytics used to identify related activity – WIN-BIN-NETCONN-TO-TELEGRAM-SHORTENED-URL, WIN-WEBBROWSER-UNUSUAL-PARENT, and WIN-STEALER-FILEMOD