Vidar — 3799d1f74d955e7f65e65ff1a35e07b94eb978992a0bea545aeb8c7a09f1c922

Family: vidar
Confidence: medium (OpenCTI label; no static family strings, no dynamic confirmation)
Status: Static-only — CAPE skipped, no Windows guest available^[dynamic-analysis.md]

Build / RE

Toolchain: Go 1.25.10, GOOS=windows, GOARCH=amd64, GOAMD64=v1, CGO_ENABLED=0, -buildmode=exe, -trimpath=true^[strings.txt:build-info].
Module path: dkPrXourxwYLmLN (randomized 14-char alphanumeric, no semantic meaning)^[strings.txt:build-info].
Build ID: gKXb8hF1q36t48Y40y7L/EduBE8mSHXqVV-ZMl6DD/-Fml84n93IU3_YFS7KTV/-CHMK_yhUzT_ya_F8cOM^[strings.txt].

Packing / obfuscation: None external. The binary is a plain Go static executable. Compile-time obfuscation consists of:

• 155 randomized main.* function names (e.g. main.Bordyq, main.Ekqqva, main.edasofqhlijff)^[strings.txt:1645]^[strings.txt:2456] — see go-function-name-randomization
• -trimpath=true strips absolute source paths from the binary^[strings.txt:build-info]
• No .rsrc section containing icon resources (distinguishes this from the ACR Stealer cluster which carries a 256×256 PNG masquerade icon)^[rabin2-info.txt]

Anti-analysis:

• No debugger checks, no VM detection, no TLS callbacks observed statically
• Only kernel32.dll in the import table^[rabin2-info.txt]; all other Win32 APIs resolved at runtime via syscall.LoadLibrary + GetProcAddress (standard Go behavior on Windows)
• PE timestamp set to 1970-01-01 00:00:00^[exiftool.json] — common in Go builds, not anti-forensics

Certificate / signing:

• Authenticode certificate table present^[pefile.txt]
• Embedded PKCS#7 blob at file offset 0x33F408 (ASN.1 seq length 2201)^[binwalk.txt]
• Certificate Subject: CN = *.merriam-webster.com
• Issuer: CN = Amazon RSA 2048 M01
• Serial: 0c:5d:6e:bc:86:90:6d:f6:03:1a:c4:0d:43:7c:23:0a
• Valid: Feb 24 2026 – Sep 9 2026
• RSA 4096-bit public key
• Assessment: Stolen or re-purposed legitimate TLS certificate (Merriam-Webster is a dictionary/reference publisher). Not a self-signed malware-author cert. See stolen-certificate-signing.

Notable static artefacts:

• High-entropy block inside .rdata at file offset ~0x2b8400 (RVA .rdata+0x118000). First 64 bytes: 070cdc070202168104160404cd0303d20701830405cd0305d4070202030609a9... — printable ratio 0.22, no recoverable strings. Likely encrypted configuration or payload segment. Without dynamic detonation, contents remain opaque.
• .text entropy is moderate (~6.2) — consistent with unobfuscated Go compiled code, not packed.

Deploy / ATT&CK

TTPs (inferred from static artefacts and family knowledge):

Persistence: Unknown from static. Vidar historically writes to HKCU\Software\Microsoft\Windows\CurrentVersion\Run or scheduled tasks; no registry strings in this sample.

C2 / network: No hardcoded URLs, IPs, Telegram bot tokens, or Discord webhooks found in static strings. The Go standard library includes net/http and crypto/tls packages (implied by Go runtime); actual C2 endpoints are expected to be stored in the encrypted .rdata block and resolved at runtime.

Attribution:

• Family: Vidar (preliminary, from OpenCTI label)^[triage.json]. No static confirmation.
• Build cluster: Fits the golang-stealer-build-pattern observed in ACR Stealer, LummaStealer, and OrderReShop clusters: Go 1.25.x, CGO_ENABLED=0, -trimpath=true, randomized module path and function names. However, this sample lacks the .rsrc icon section common to most ACR siblings, and uses a stolen legitimate certificate rather than a fabricated self-signed or low-reputation CA cert.
• Confidence note: Medium. The static profile is consistent with commodity Go infostealers but could also represent a distinct family or fork using the same builder. Without dynamic detonation or C2 IOCs, attribution rests on the OpenCTI label alone.

Summary

A Go 1.25.10 PE64+ infostealer with heavy compile-time obfuscation (randomized module path dkPrXourxwYLmLN, 155 randomized main.* symbols, -trimpath). Signed with a stolen Amazon-issued certificate for *.merriam-webster.com. No static C2 strings; a high-entropy .rdata block at +0x118000 is the likely encrypted config/payload container. No dynamic data available — CAPE skipped for lack of a Windows guest. Preliminary family label is vidar (OpenCTI), but static confirmation is absent.