Peeling Back the Layers: Inside Vidar - From Virtualized Code to Stolen Credentials
Vidar is a password-stealing malware that hides its code inside a fake virtual machine to avoid detection. It grabs saved passwords from browsers, FTP tools, and Microsoft accounts, then sends the data to a Telegram channel.
- Report priority
- High
- Targets
- credential theft+3 more
How it works
- Vidar starts by running inside a custom virtual machine that hides its real code.
- It checks for debuggers, antivirus software, and unusual system activity to avoid being caught.
- Once running, it steals saved passwords from browsers like Chrome and Firefox, FTP tools like FileZilla, and Microsoft accounts.
- It also takes screenshots and sends everything to a Telegram channel.
- The malware runs hidden to avoid detection and removes its own files afterward.
What to do
If you opened a fake installer or visited a hacked site on Windows, check for unexpected files like random executables or hidden processes in Task Manager. Look for unusual Telegram messages or screenshots you didn't take.
Delete any suspicious files immediately. Run a full antivirus scan with Windows Defender or a trusted third-party tool. Reset passwords for all accounts accessed by browsers or FTP tools. Monitor your Microsoft and Telegram accounts for unauthorized activity.
Technical details
Affected software: credential theft, vidar, anti-analysis, virtualization obfuscation
An attacker sends a fake software installer via email or a hacked website. When opened, it runs Vidar's hidden virtual machine, steals passwords, and sends them to a Telegram channel controlled by the attacker.
A new Vidar infostealer variant uses a custom virtual machine to obfuscate its code via proprietary bytecode interpretation, evading detection through multiple anti-analysis techniques. The malware detects debuggers via NtQueryInformationProcess and RDTSC timing checks, identifies sandbox environments by monitoring antivirus processes and system resources, and performs environment fingerprinting. It steals credentials from Chromium and Gecko-based browsers, Azure authentication tokens, FileZilla FTP credentials, and captures screenshots.
To maintain persistence, it elevates privileges using SeDebugPrivilege, creates hidden desktops for browser automation, and exfiltrates stolen data through Telegram channels. The malware also cleans up execution artifacts and disguises its DLL execution by proxying it through rundll32.exe.