Vidar

Commodity Windows infostealer family, typically distributed via spam campaigns and malvertising. Two observed samples in this corpus with divergent toolchains:

1. Go variant (3799d1f74d95) — Go 1.25.10, randomized module path, stolen Amazon-issued Authenticode for *.merriam-webster.com. See golang-stealer-build-pattern.
2. MSVC variant (d4b6905ef14c) — MSVC 14.41 C++ stub with 1.1 MB encrypted payload in .data, FreeConsole + PRNG Sleep gate, RWX VirtualAlloc, rolling-XOR decryption. See msvc-stub-data-section-payload-loader.

The toolchain divergence suggests either a multi-builder distribution pipeline or a commodity crypter service used by the same actor group.

Capabilities

• browser-credential-theft-chrome-firefox-edge-opera
• crypto-wallet-theft-bitcoin-ethereum-monero
• system-information-gathering
• screenshot-capture
• config-file-theft-ftp-vpn
• clipboard-hijack-cryptocurrency
• telegram-c2-exfiltration
• runtime-encrypted-config-storage
• stolen-authenticode-certificate-signing (Go variant only)
• data-section-encrypted-payload-loader (MSVC variant)
• freeconsole-stealth-initialization
• prng-sleep-anti-emulation
• virtualalloc-rwx-payload-staging
• rolling-xor-payload-decryption

Build Patterns

Go variant

Observed sample 3799d1f74d95 follows the golang-stealer-build-pattern: Go 1.25.10, CGO_ENABLED=0, -trimpath=true, randomized module path (dkPrXourxwYLmLN), and 155 randomized main.* function names. See go-function-name-randomization.

MSVC variant

Observed sample d4b6905ef14c is an MSVC 14.41 C++ stub with a plain WinMain → FreeConsole → Sleep → VirtualAlloc(RWX) → decrypt → call chain. No obfuscation beyond the encrypted payload. See msvc-stub-data-section-payload-loader.

References

• ^[/intel/analyses/3799d1f74d955e7f65e65ff1a35e07b94eb978992a0bea545aeb8c7a09f1c922.html] — First observed sample (Go variant).
• ^[/intel/analyses/d4b6905ef14c2c13a69b31585be4a6a8e49f0918f1ef1406936b7f6f7ecc37b3.html] — Second observed sample (MSVC variant), static-only.