{ "intelligence": { "actors": [], "counts": { "actors": 0, "associated_entity_contexts": 1, "deduplicated_iocs": 12, "direct_entities": 23, "direct_relationships": 22, "invalid_iocs": 0, "iocs": 10, "mentioned": 1, "mitre_associated": 4, "mitre_direct": 0, "targets": 0, "techniques": 0, "unsupported_indicators": 0, "vulnerabilities": 0 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 219, "excluded_graph_objects": 168, "graph_complete": true, "graph_objects": 23, "graph_relationships": 22, "mitre_context_complete": true, "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "status_as_of": "2026-10-10T19:50:06+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-08-23T12:43:56.874Z", "updated_at": "2026-10-03T01:09:08.840Z" }, "description_available": false, "entity_type": "StixFile", "id": "1d0d170b-5d1a-4711-8893-21cc120fa924", "is_inferred": false, "labels": [ "2cloader", "anti-analysis", "arx cipher", "bytecode interpreter", "chacha20", "custom stream cipher", "evasion techniques", "indirect syscalls", "information stealer", "loader", "none", "payload", "payload encryption", "remus", "string obfuscation", "vidar", "virtual machine", "xworm" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "file--27bc4ce4-ff78-5868-8923-39a5838f4143", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-08-23T12:43:32.828Z", "updated_at": "2026-10-03T01:09:10.870Z" }, "description_available": false, "entity_type": "StixFile", "id": "275b90ad-5b26-4263-bfb8-6cdb07e8485a", "is_inferred": false, "labels": [ "2cloader", "anti-analysis", "arx cipher", "bytecode interpreter", "chacha20", "custom stream cipher", "evasion techniques", "indirect syscalls", "information stealer", "loader", "none", "payload", "payload encryption", "remus", "string obfuscation", "vidar", "virtual machine", "xworm" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "file--07a1ee0c-02eb-54d8-8790-339e775e3fcc", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:52.235Z", "created_at": "2026-09-26T18:36:35.409Z", "modified": "2026-09-26T18:37:10.053Z", "updated_at": "2026-09-26T18:37:10.053Z" }, "description_available": false, "entity_type": "Indicator", "id": "287a1051-1bb6-44e6-9f59-6f101377fc73", "is_inferred": false, "labels": [ "arx cipher", "bytecode interpreter", "chacha20", "custom stream cipher", "information stealer", "string obfuscation", "vidar", "virtual machine" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "indicator--b630f7cc-4fc0-5cfc-9842-cb0694e96664", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:52.221Z", "created_at": "2026-09-26T18:36:31.401Z", "modified": "2026-09-26T18:36:40.238Z", "updated_at": "2026-09-26T18:36:40.238Z" }, "description_available": false, "entity_type": "Indicator", "id": "2e64b5ee-6efb-484f-9c90-bed755a78543", "is_inferred": false, "labels": [ "arx cipher", "bytecode interpreter", "chacha20", "custom stream cipher", "information stealer", "string obfuscation", "vidar", "virtual machine" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "indicator--828fdc3f-6d11-5e3a-bc73-3cb9f40346e7", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "indicator_types": [ "sha1" ], "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 45, "created_by": null, "dates": { "created": "2026-08-23T12:19:56.418Z", "created_at": "2026-08-23T12:43:25.043Z", "modified": "2026-08-23T13:18:46.004Z", "updated_at": "2026-08-23T13:18:46.004Z" }, "description_available": false, "entity_type": "Indicator", "id": "33210948-1360-4560-b195-9d363c8331b0", "is_inferred": false, "labels": [ "none", "payload" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "indicator--bc5a6f31-62f2-51d9-99ff-be566eed7fdd", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:36:23.845Z", "updated_at": "2026-09-26T18:36:24.383Z" }, "description_available": false, "entity_type": "StixFile", "id": "40d65b34-7d96-4152-94cd-68ee5e4582f2", "is_inferred": false, "labels": [ "arx cipher", "bytecode interpreter", "chacha20", "custom stream cipher", "information stealer", "string obfuscation", "vidar", "virtual machine" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "file--b473d279-b655-5eb0-b247-c6c1904c1dd3", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "indicator_types": [ "sha1" ], "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 45, "created_by": null, "dates": { "created": "2026-09-13T12:23:48.862Z", "created_at": "2026-09-13T12:52:11.401Z", "modified": "2026-09-13T13:40:04.736Z", "updated_at": "2026-09-13T13:40:04.736Z" }, "description_available": false, "entity_type": "Indicator", "id": "4efc8e66-b1d4-480a-acff-32e729664e4e", "is_inferred": false, "labels": [ "none", "payload" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "indicator--ef793510-abe1-5de1-b13e-cee44a0a3a43", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:52.218Z", "created_at": "2026-09-26T18:36:27.613Z", "modified": "2026-10-03T01:12:48.554Z", "updated_at": "2026-10-03T01:12:48.554Z" }, "description_available": false, "entity_type": "Indicator", "id": "724dafcc-ca72-4b95-80df-50e74ea5dbd0", "is_inferred": false, "labels": [ "2cloader", "anti-analysis", "arx cipher", "bytecode interpreter", "chacha20", "custom stream cipher", "evasion techniques", "indirect syscalls", "information stealer", "loader", "payload encryption", "remus", "string obfuscation", "vidar", "virtual machine", "xworm" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "indicator--73b522c0-37cd-5b4b-b2b9-581c6958b2db", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "indicator_types": [ "md5" ], "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-23T12:19:56.422Z", "created_at": "2026-08-23T12:43:35.097Z", "modified": "2026-10-03T01:12:25.099Z", "updated_at": "2026-10-03T01:12:25.099Z" }, "description_available": false, "entity_type": "Indicator", "id": "74abf3eb-6c0c-417e-aa76-c65fa47b4190", "is_inferred": false, "labels": [ "2cloader", "anti-analysis", "arx cipher", "bytecode interpreter", "chacha20", "custom stream cipher", "evasion techniques", "indirect syscalls", "information stealer", "loader", "none", "payload", "payload encryption", "remus", "string obfuscation", "vidar", "virtual machine", "xworm" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "indicator--8921beb2-2e82-5b4e-b52e-6b5d5bf5cefb", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:52.242Z", "created_at": "2026-09-26T18:36:48.948Z", "modified": "2026-09-26T18:37:50.641Z", "updated_at": "2026-09-26T18:37:50.641Z" }, "description_available": false, "entity_type": "Indicator", "id": "758cafb6-b456-4c98-8af5-397379c6973c", "is_inferred": false, "labels": [ "arx cipher", "bytecode interpreter", "chacha20", "custom stream cipher", "information stealer", "string obfuscation", "vidar", "virtual machine" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "indicator--c6ce5abe-6398-52d0-af83-d9c60a32886e", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "indicator_types": [ "sha256" ], "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-13T12:23:48.880Z", "created_at": "2026-09-13T12:52:19.936Z", "modified": "2026-09-26T18:36:35.232Z", "updated_at": "2026-09-26T18:36:35.232Z" }, "description_available": false, "entity_type": "Indicator", "id": "7c27d6fc-2fb2-4897-9b86-0bd714beac6b", "is_inferred": false, "labels": [ "arx cipher", "bytecode interpreter", "chacha20", "custom stream cipher", "information stealer", "none", "payload", "string obfuscation", "vidar", "virtual machine" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "indicator--dd8ca513-4e8b-5754-8dd6-9584a9c2dae1", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-08-23T12:43:24.930Z", "updated_at": "2026-10-03T01:09:22.027Z" }, "description_available": false, "entity_type": "StixFile", "id": "81b854bf-f297-4f3d-a45b-1b13dd94d6a7", "is_inferred": false, "labels": [ "2cloader", "anti-analysis", "arx cipher", "bytecode interpreter", "chacha20", "custom stream cipher", "evasion techniques", "indirect syscalls", "information stealer", "loader", "none", "payload", "payload encryption", "remus", "string obfuscation", "vidar", "virtual machine", "xworm" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "file--75ab7a18-139c-58e4-a3ed-fe12c937e34e", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-13T12:52:11.659Z", "updated_at": "2026-09-26T18:36:23.401Z" }, "description_available": false, "entity_type": "StixFile", "id": "bb57e773-95c6-4db2-a80c-20211988f8df", "is_inferred": false, "labels": [ "arx cipher", "bytecode interpreter", "chacha20", "custom stream cipher", "information stealer", "none", "payload", "string obfuscation", "vidar", "virtual machine" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "file--615212ed-cbbb-505d-9396-8582c4b2d7c0", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:36:24.485Z", "updated_at": "2026-09-26T18:36:24.755Z" }, "description_available": false, "entity_type": "StixFile", "id": "c004ce0f-d221-40cf-989b-53145f8df99e", "is_inferred": false, "labels": [ "arx cipher", "bytecode interpreter", "chacha20", "custom stream cipher", "information stealer", "string obfuscation", "vidar", "virtual machine" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "file--78cce672-37d1-5eaa-a5f7-3e6506975851", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:52.238Z", "created_at": "2026-09-26T18:36:43.861Z", "modified": "2026-09-26T18:37:28.296Z", "updated_at": "2026-09-26T18:37:28.296Z" }, "description_available": false, "entity_type": "Indicator", "id": "c71f78c3-5afa-4841-acad-609accb87504", "is_inferred": false, "labels": [ "arx cipher", "bytecode interpreter", "chacha20", "custom stream cipher", "information stealer", "string obfuscation", "vidar", "virtual machine" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "indicator--7bfe1440-7c56-5ac6-814e-20cd3aba8f22", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:52.231Z", "created_at": "2026-09-26T18:36:35.217Z", "modified": "2026-09-26T18:36:56.591Z", "updated_at": "2026-09-26T18:36:56.591Z" }, "description_available": false, "entity_type": "Indicator", "id": "c71fc708-e26c-4dac-b514-b12ca97c79cd", "is_inferred": false, "labels": [ "arx cipher", "bytecode interpreter", "chacha20", "custom stream cipher", "information stealer", "string obfuscation", "vidar", "virtual machine" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "indicator--c147f888-46ab-5f6e-9aef-6ff6f3e98115", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-13T12:52:14.677Z", "updated_at": "2026-09-26T18:36:23.926Z" }, "description_available": false, "entity_type": "StixFile", "id": "cf9a0b09-a025-4843-a359-62b3dc6a6ce2", "is_inferred": false, "labels": [ "arx cipher", "bytecode interpreter", "chacha20", "custom stream cipher", "information stealer", "none", "payload", "string obfuscation", "vidar", "virtual machine" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "file--ce1649d3-e353-5e8c-8265-bd531a168a51", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "indicator_types": [ "sha256" ], "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-23T12:19:56.435Z", "created_at": "2026-08-23T12:44:00.794Z", "modified": "2026-10-03T01:12:17.975Z", "updated_at": "2026-10-03T01:12:17.975Z" }, "description_available": false, "entity_type": "Indicator", "id": "d0123925-33eb-4d96-843b-15ba44dd4ffd", "is_inferred": false, "labels": [ "2cloader", "anti-analysis", "arx cipher", "bytecode interpreter", "chacha20", "custom stream cipher", "evasion techniques", "indirect syscalls", "information stealer", "loader", "none", "payload", "payload encryption", "remus", "string obfuscation", "vidar", "virtual machine", "xworm" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "indicator--21d8be52-39d9-5dc0-8b37-ad1fb5ce6ee2", "type": "Indicator" }, { "__typename": "Malware", "aliases": [ "win.vidar" ], "attributes": { "is_family": true, "malware_types": [ "bot" ] }, "authorized_members": [], "confidence": 50, "created_by": { "authorized_members": [], "id": "1b7caa41-88e1-4a38-8cfc-62b85639333a", "is_inferred": false, "name": "Malpedia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2026-01-18T19:55:22.473Z", "created_at": "2026-01-19T02:35:26.049Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-10-10T18:33:01.505Z", "updated_at": "2026-10-10T18:33:01.505Z" }, "description_available": true, "entity_type": "Malware", "id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "is_inferred": false, "labels": [ "none", "payload" ], "lang": "en", "name": "Vidar", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "b07168f5-8437-4277-8a54-c9b0684243e8", "source_name": "CISA Scattered Spider Advisory November 2023", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a" }, { "external_id": null, "id": "fdc366e9-5d5c-4df6-bf9a-e88e5fe2c97a", "source_name": "Crowdstrike GTR2020 Mar 2020", "url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf" }, { "external_id": null, "id": "a3a42365-4ea0-4d07-82fc-d8c82cfae72c", "source_name": "Google Cloud Threat Intelligence UNC5537 Snowflake 2024", "url": "https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion" }, { "external_id": null, "id": "27e6d3ed-714e-413d-b0a6-1349a7a7d09b", "source_name": "SecureWorks Infostealers 2023", "url": "https://www.secureworks.com/research/the-growing-threat-from-infostealers" }, { "external_id": null, "id": "315614d7-7c65-4419-a167-40bb4db07b85", "source_name": "ThreatFox source reference", "url": "https://www.netskope.com/jp/blog/openclaw-hologram-fake-installer-ships-rust-infostealer" }, { "external_id": null, "id": "4d3b593a-fcd6-4e4b-acba-dc408fcddff7", "source_name": "alien-vault", "url": "https://www.microsoft.com/en-us/security/blog/2026/05/19/exposing-fox-tempest-a-malware-signing-service-operation/" }, { "external_id": null, "id": "161f170f-63e6-44eb-b6f8-7c0cf4b17c97", "source_name": "alien-vault", "url": "https://www.netskope.com/blog/100k-in-crypto-drained-by-the-underground-operation" }, { "external_id": null, "id": "ce02fb10-84f3-492c-9e33-56b2c8dd3e27", "source_name": "alien-vault", "url": "https://www.zscaler.com/blogs/security-research/2cloader-new-malware-loader-delivering-vidar-and-remus" }, { "external_id": null, "id": "c18f8042-10bc-41a5-abfd-f63080e34db5", "source_name": "alien-vault", "url": "https://www.zscaler.com/blogs/security-research/anthropic-claude-code-leak" }, { "external_id": null, "id": "a79f9cc2-2aba-4526-a227-7f4eb96744c2", "source_name": "malpedia", "url": "https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/" }, { "external_id": null, "id": "b5ce39c9-b188-4d8c-a19f-c6e01bd3f50f", "source_name": "malpedia", "url": "https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/" }, { "external_id": null, "id": "0636d89a-e1ae-4fe0-b613-f7f10fcf360d", "source_name": "malpedia", "url": "https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign" }, { "external_id": null, "id": "ab97bac8-5bea-4d1c-9402-5d566be242f3", "source_name": "malpedia", "url": "https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/" }, { "external_id": null, "id": "7620bd6e-959f-47c9-8383-b14412fdb3ed", "source_name": "malpedia", "url": "https://asec.ahnlab.com/en/22932/" }, { "external_id": null, "id": "74501a51-5a3f-4ab5-81aa-1af41dfc2a61", "source_name": "malpedia", "url": "https://asec.ahnlab.com/en/30445/" }, { "external_id": null, "id": "1ea065cd-3334-4f40-865f-37f8c7250eb2", "source_name": "malpedia", "url": "https://asec.ahnlab.com/en/30875/" }, { "external_id": null, "id": "ebdc2405-ff27-42a8-87d1-b4002ff0da87", "source_name": "malpedia", "url": "https://asec.ahnlab.com/ko/25837/" }, { "external_id": null, "id": "c40f38b9-28ed-483b-8728-b60834377d6a", "source_name": "malpedia", "url": "https://aviab1.github.io/Vidar-Stealer/" }, { "external_id": null, "id": "882a4b2e-61ed-4c20-b475-6fd3b8cf1170", "source_name": "malpedia", "url": "https://aviab1.github.io/blog/vidar-stealer/" }, { "external_id": null, "id": "25d4aa54-82c9-4f86-9ab1-8866c603fdae", "source_name": "malpedia", "url": "https://blog.cyble.com/2022/11/08/massive-youtube-campaign-targeting-over-100-applications-to-deliver-info-stealer/" }, { "external_id": null, "id": "4b04e91f-69ed-4ee6-92ee-2870c0b24b7a", "source_name": "malpedia", "url": "https://blog.jaalma.io/vidar-infostealer-analysis/" }, { "external_id": null, "id": "f37f9192-a65d-4c0a-aad2-8c675db1abe2", "source_name": "malpedia", "url": "https://blog.malwarebytes.com/threat-analysis/2019/01/vidar-gandcrab-stealer-and-ransomware-combo-observed-in-the-wild/" }, { "external_id": null, "id": "e01a3ae4-657d-49f1-a294-5645264c1971", "source_name": "malpedia", "url": "https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/" }, { "external_id": null, "id": "30e6b853-b8a0-41d0-84c7-ad5f2018a2f4", "source_name": "malpedia", "url": "https://blog.minerva-labs.com/vidar-stealer-evasion-arsenal" }, { "external_id": null, "id": "3a386a0a-a61e-4840-8d91-1d7aafce6263", "source_name": "malpedia", "url": "https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/" }, { "external_id": null, "id": "548d2d9d-84e8-4a6d-a7b5-4093b981f5c5", "source_name": "malpedia", "url": "https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/" }, { "external_id": null, "id": "f8789f76-36ac-4de1-9982-f650f7ebe48b", "source_name": "malpedia", "url": "https://blog.sekoia.io/traffers-a-deep-dive-into-the-information-stealer-ecosystem" }, { "external_id": null, "id": "c756766b-ffa8-4da4-bae0-3e196186546b", "source_name": "malpedia", "url": "https://blogs.microsoft.com/on-the-issues/2026/05/19/disrupting-fox-tempest-a-cybercrime-service/" }, { "external_id": null, "id": "39008d19-95d9-4736-a3ab-6408be474770", "source_name": "malpedia", "url": "https://bluecyber.hashnode.dev/analysis-of-a-clickfix-malware-attack" }, { "external_id": null, "id": "9163fb68-2725-42ad-a2f3-9ee6c3897fc2", "source_name": "malpedia", "url": "https://censys.com/a-beginners-guide-to-hunting-open-directories/" }, { "external_id": null, "id": "3de11371-3ec9-4dbe-b23c-3ab3fb1d9ab0", "source_name": "malpedia", "url": "https://censys.com/tracking-vidar-infrastructure/" }, { "external_id": null, "id": "00de0b28-9da7-44d3-b20a-f0c6bc4062fd", "source_name": "malpedia", "url": "https://cert.pl/en/posts/2021/10/vidar-campaign/" }, { "external_id": null, "id": "2ae1aaed-34f7-4a1d-8c8d-34453d77013b", "source_name": "malpedia", "url": "https://community.emergingthreats.net/t/vidar-stealer-picks-up-steam/271" }, { "external_id": null, "id": "2022b586-d094-4c2f-8dc2-bc3fc1fc2303", "source_name": "malpedia", "url": "https://darktrace.com/blog/vidar-info-stealer-malware-distributed-via-malvertising-on-google" }, { "external_id": null, "id": "e5c2a3cf-9444-49ee-a39d-7edf95f2e567", "source_name": "malpedia", "url": "https://docs.google.com/spreadsheets/d/1nx42rdMdkCrvlmACDi3CHseyG87iSV1Y6rGZYq_-oDk" }, { "external_id": null, "id": "3e140f7e-7832-45f8-9303-fed8a0be9c7d", "source_name": "malpedia", "url": "https://eln0ty.github.io/malware%20analysis/vidar/" }, { "external_id": null, "id": "41c270fd-fdea-4e41-bccc-592f6d03d029", "source_name": "malpedia", "url": "https://embee-research.ghost.io/ghidra-basics-identifying-and-decoding-encrypted-strings/" }, { "external_id": null, "id": "eec510f9-1d6a-4161-a5b6-4230aaea09ee", "source_name": "malpedia", "url": "https://fumik0.com/2018/12/24/lets-dig-into-vidar-an-arkei-copycat-forked-stealer-in-depth-analysis/" }, { "external_id": null, "id": "cd7046ef-4682-40f8-9303-02af670db56e", "source_name": "malpedia", "url": "https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-vidar-2c0a62a73087" }, { "external_id": null, "id": "cc815ae2-b2c9-4f83-90f1-b7da62776dcb", "source_name": "malpedia", "url": "https://go.recordedfuture.com/hubfs/reports/cta-2022-0802.pdf" }, { "external_id": null, "id": "a3d1e275-49f9-4c17-bb2e-4a5a29bff402", "source_name": "malpedia", "url": "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf" }, { "external_id": null, "id": "f2474ac9-4f53-465f-91da-481f5f40d74e", "source_name": "malpedia", "url": "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf" }, { "external_id": null, "id": "45cc5f0d-297f-4ea5-9a23-b0840be23a23", "source_name": "malpedia", "url": "https://insights.loaderinsight.agency/posts/vidar-build-id-correlation/" }, { "external_id": null, "id": "4ad0988b-8644-42e1-973b-fb6ca298277f", "source_name": "malpedia", "url": "https://intel471.com/blog/privateloader-malware" }, { "external_id": null, "id": "1721fa81-5f88-4f65-bfd2-1c146f74ae36", "source_name": "malpedia", "url": "https://isc.sans.edu/diary/Arkei+Variants%3A+From+Vidar+to+Mars+Stealer/28468" }, { "external_id": null, "id": "6ab5165a-b028-49ca-9beb-adf794aef6b7", "source_name": "malpedia", "url": "https://isc.sans.edu/diary/rss/28468" }, { "external_id": null, "id": "d20a0fbb-e7b3-44cf-9a33-d733d87af3e5", "source_name": "malpedia", "url": "https://ke-la.com/information-stealers-a-new-landscape/" }, { "external_id": null, "id": "651c601f-90ba-4f7c-885b-e9dbbc695436", "source_name": "malpedia", "url": "https://kienmanowar.wordpress.com/2022/12/17/quicknote-vidarstealer-analysis/" }, { "external_id": null, "id": "5d20e3ed-cd26-446d-a352-d18cee48c6e0", "source_name": "malpedia", "url": "https://m4lcode.github.io/malware%20analysis/vidar/" }, { "external_id": null, "id": "9a321d90-7223-4556-afa2-c3d7c26dfdee", "source_name": "malpedia", "url": "https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar" }, { "external_id": null, "id": "3f18b077-9a47-478b-8c14-c6e78239042e", "source_name": "malpedia", "url": "https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145" }, { "external_id": null, "id": "40852be7-93a6-4071-b802-ea81ffcbabd7", "source_name": "malpedia", "url": "https://medium.com/s2wlab/deep-analysis-of-vidar-stealer-ebfc3b557aed" }, { "external_id": null, "id": "f87098ea-982e-4ca3-91ff-a85acccd6b1e", "source_name": "malpedia", "url": "https://medium.com/s2wlab/w1-feb-en-story-of-the-week-stealers-on-the-darkweb-49945a31601d" }, { "external_id": null, "id": "ff6d34bd-9f69-4f64-803a-edf92e77c59a", "source_name": "malpedia", "url": "https://mrtiepolo.medium.com/operation-turb00-analyzing-and-hunting-a-vidar-campaign-b45481d8cd74" }, { "external_id": null, "id": "88962bed-f49a-4cc0-84ea-5a468d434674", "source_name": "malpedia", "url": "https://research.checkpoint.com/2022/bumblebee-increasing-its-capacity-and-evolving-its-ttps/" }, { "external_id": null, "id": "37052f99-f620-4f03-9522-299e4addcf20", "source_name": "malpedia", "url": "https://securelist.com/nullmixer-oodles-of-trojans-in-a-single-dropper/107498/" }, { "external_id": null, "id": "f702625e-9cff-4fd3-ba4e-9fde402d4f1f", "source_name": "malpedia", "url": "https://socprime.com/blog/somnia-malware-detection-uac-0118-aka-frwl-launches-cyber-attacks-against-organizations-in-ukraine-using-enhanced-malware-strains/" }, { "external_id": null, "id": "51f93c5a-018f-44e5-9f4b-2655929acdd6", "source_name": "malpedia", "url": "https://tccontre.blogspot.com/2019/03/infor-stealer-vidar-trojanspy-analysis.html" }, { "external_id": null, "id": "436e87a6-ae77-4932-8cad-53b5c3781f4c", "source_name": "malpedia", "url": "https://therecord.media/microsoft-disrupts-fox-tempest-malware-signing-service" }, { "external_id": null, "id": "599fed37-d621-4b4e-80ea-f873b62dcb22", "source_name": "malpedia", "url": "https://threatpost.com/microsoft-help-files-vidar-malware/179078/" }, { "external_id": null, "id": "c09edf0b-a523-45b0-b3eb-aa5685db8db2", "source_name": "malpedia", "url": "https://twitter.com/GroupIB_GIB/status/1570821174736850945" }, { "external_id": null, "id": "1c4671d7-f555-4c4b-9518-f8dc84c12d79", "source_name": "malpedia", "url": "https://twitter.com/sisoma2/status/1409816282065743872" }, { "external_id": null, "id": "28e9cc9b-7162-46c4-8fc2-b217af969b91", "source_name": "malpedia", "url": "https://viuleeenz.github.io/posts/2023/10/vidar-payload-inspection-with-static-analysis/" }, { "external_id": null, "id": "fdd5b398-dd30-4b4a-8a37-d72fa7fd5259", "source_name": "malpedia", "url": "https://www.aryaka.com/docs/reports/vidar-infostealer-in-action.pdf" }, { "external_id": null, "id": "b7f61ecd-f15f-4b86-b0a4-430a3d63d509", "source_name": "malpedia", "url": "https://www.bleepingcomputer.com/news/security/fake-pixelmon-nft-site-infects-you-with-password-stealing-malware/" }, { "external_id": null, "id": "eb53b48c-85bb-4da8-a13f-6be517163fed", "source_name": "malpedia", "url": "https://www.bleepingcomputer.com/news/security/gandcrab-operators-use-vidar-infostealer-as-a-forerunner/" }, { "external_id": null, "id": "144a11f1-092e-4ea9-a743-75eb0007a2af", "source_name": "malpedia", "url": "https://www.cisa.gov/sites/default/files/2023-11/aa23-320a_scattered_spider.pdf" }, { "external_id": null, "id": "e87c6fee-2b0a-4d3a-88ca-d67bafb7ed27", "source_name": "malpedia", "url": "https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware" }, { "external_id": null, "id": "b19787e9-2200-4f14-9844-e3622b90c19b", "source_name": "malpedia", "url": "https://www.csoonline.com/article/3654849/microsoft-help-files-repurposed-to-contain-vidar-malware-in-new-campaign.html" }, { "external_id": null, "id": "8d96a3c6-3b3d-4465-a166-0081f5d49646", "source_name": "malpedia", "url": "https://www.cybereason.com/blog/the-hole-in-the-bucket-attackers-abuse-bitbucket-to-deliver-an-arsenal-of-malware" }, { "external_id": null, "id": "31f78e34-0cba-4b4d-bce0-934b4688f9a5", "source_name": "malpedia", "url": "https://www.cynet.com/blog/cyops-lighthouse-vidar-stealer/" }, { "external_id": null, "id": "adf1ff42-2277-4c05-9f78-d494d454d2fc", "source_name": "malpedia", "url": "https://www.derp.ca/research/vidar-go-sandbox-dead-drop/" }, { "external_id": null, "id": "7812be83-4306-4338-add7-17d21fe13f90", "source_name": "malpedia", "url": "https://www.elastic.co/security-labs/ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks" }, { "external_id": null, "id": "80a643a1-b36d-4794-89ef-f6dc0ad08d3d", "source_name": "malpedia", "url": "https://www.esentire.com/blog/batloader-continues-to-abuse-google-search-ads-to-deliver-vidar-stealer-and-ursnif" }, { "external_id": null, "id": "67cf60d1-24de-4e6e-8b06-a14c3ac2dc6b", "source_name": "malpedia", "url": "https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-batloader" }, { "external_id": null, "id": "5937af53-7bcd-4b12-8caf-65d031c525af", "source_name": "malpedia", "url": "https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-vidar-stealer" }, { "external_id": null, "id": "f0776771-b7ac-40d9-a2fb-dc35b049a195", "source_name": "malpedia", "url": "https://www.fortinet.com/blog/threat-research/the-year-of-the-wiper" }, { "external_id": null, "id": "9a123075-ec9d-4bbf-85d6-c6f2b956baec", "source_name": "malpedia", "url": "https://www.gatewatcher.com/lab/utilisation-de-faux-profils-steam-vidar-prend-les-commandes/" }, { "external_id": null, "id": "2166b1bf-fd3f-4c82-a780-9b1ff92bdc13", "source_name": "malpedia", "url": "https://www.gendigital.com/blog/insights/research/inside-vidar-abe-bypass" }, { "external_id": null, "id": "07f17402-3042-46aa-bca5-fb9c5e1b197d", "source_name": "malpedia", "url": "https://www.huntress.com/blog/openclaw-github-ghostsocks-infostealer" }, { "external_id": null, "id": "016447cd-3bd9-4743-ba97-c2e1fe1968d0", "source_name": "malpedia", "url": "https://www.kroll.com/en/insights/publications/cyber/threat-actors-google-ads-deploy-vidar-stealer" }, { "external_id": null, "id": "2510035d-f8c2-41fc-8f87-10bdb1bb66df", "source_name": "malpedia", "url": "https://www.logpoint.com/wp-content/uploads/2024/03/logpoint-etpr-a-comprehensive-overview-on-stealer-malware-families.pdf" }, { "external_id": null, "id": "1e5f05bb-9433-410d-a9b3-4bfbb4456c5c", "source_name": "malpedia", "url": "https://www.quorumcyber.com/wp-content/uploads/2023/01/Malware-Analysis-Vidar.pdf" }, { "external_id": null, "id": "32da9166-004f-4b67-824a-b7bd88d6389e", "source_name": "malpedia", "url": "https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-july-to-december-2025/" }, { "external_id": null, "id": "30391646-1f3d-4dbc-80d2-eb785b9ee705", "source_name": "malpedia", "url": "https://www.team-cymru.com/post/darth-vidar-the-aesir-strike-back" }, { "external_id": null, "id": "f298c706-5815-4e7b-b43a-14d03c673117", "source_name": "malpedia", "url": "https://www.team-cymru.com/post/darth-vidar-the-dark-side-of-evolving-threat-infrastructure" }, { "external_id": null, "id": "ce6bac6d-df0e-46a7-a904-110fa0be1ddc", "source_name": "malpedia", "url": "https://www.trendmicro.com/en_us/research/21/i/fake-installers-drop-malware-and-open-doors-for-opportunistic-attackers.html" }, { "external_id": null, "id": "1c3915de-b531-4093-808a-6375e9e610c3", "source_name": "malpedia", "url": "https://www.trendmicro.com/en_us/research/25/e/tiktok-videos-infostealers.html" }, { "external_id": null, "id": "22c0e0b7-f2de-4f07-bcd7-0097042715d6", "source_name": "malpedia", "url": "https://www.trendmicro.com/en_us/research/25/j/how-vidar-stealer-2-upgrades-infostealer-capabilities.html" }, { "external_id": null, "id": "867cc050-4804-4c9d-b78d-12dc8af83e0e", "source_name": "malpedia", "url": "https://www.trendmicro.com/en_us/research/26/d/weaponizing-trust-claude-code-lures-and-github-release-payloads.html" }, { "external_id": null, "id": "e14c0692-55e1-4b8e-99a9-050b3d1598fa", "source_name": "malpedia", "url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/vidar-malware-launcher-concealed-in-help-file/" }, { "external_id": null, "id": "9bb7bd95-75d4-41f7-9861-c65b553f24d4", "source_name": "malpedia", "url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation" }, { "external_id": null, "id": "3a79d954-536f-42ea-ba34-9453a5d4dcc5", "source_name": "malpedia", "url": "https://www.zscaler.com/blogs/security-research/vidar-distributed-through-backdoored-windows-11-downloads-and-abusing" }, { "external_id": null, "id": "f23130ab-88c4-407b-843e-9ef2b0cf7fc6", "source_name": "malpedia", "url": "https://xer0xe9.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/" }, { "external_id": null, "id": "adbe0b48-4d08-42c2-af25-a3943badf5c2", "source_name": "malpedia", "url": "https://xer0xe9.github.io/A-Case-of-Vidar-Infostealer-Part-2/" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "malware--7411d5ab-6535-5874-b5e2-43fe642028a5", "type": "Malware" }, { "__typename": "Indicator", "aliases": [], "attributes": { "indicator_types": [ "md5" ], "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-13T12:23:48.867Z", "created_at": "2026-09-13T12:52:12.253Z", "modified": "2026-09-26T18:36:34.913Z", "updated_at": "2026-09-26T18:36:34.913Z" }, "description_available": false, "entity_type": "Indicator", "id": "e84c1064-6cbb-4626-851d-6969217bdd15", "is_inferred": false, "labels": [ "arx cipher", "bytecode interpreter", "chacha20", "custom stream cipher", "information stealer", "none", "payload", "string obfuscation", "vidar", "virtual machine" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "indicator--d2455f63-3cbb-59b1-9074-bd34207df628", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-13T12:52:10.958Z", "updated_at": "2026-09-26T18:36:23.057Z" }, "description_available": false, "entity_type": "StixFile", "id": "f347e95e-cb93-4771-a1e0-1715b03da4bb", "is_inferred": false, "labels": [ "arx cipher", "bytecode interpreter", "chacha20", "custom stream cipher", "information stealer", "none", "payload", "string obfuscation", "vidar", "virtual machine" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "file--99bd2e60-2b88-529d-8ee3-ec74d5836c38", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:36:23.378Z", "updated_at": "2026-09-26T18:36:23.661Z" }, "description_available": false, "entity_type": "StixFile", "id": "f3d77d60-32b4-4c91-82a7-418720d9deb4", "is_inferred": false, "labels": [ "arx cipher", "bytecode interpreter", "chacha20", "custom stream cipher", "information stealer", "string obfuscation", "vidar", "virtual machine" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "file--a657df39-03cc-50d3-a483-082b8a514934", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:36:25.394Z", "updated_at": "2026-09-26T18:36:25.722Z" }, "description_available": false, "entity_type": "StixFile", "id": "f5d6f37f-0264-4cb9-a052-97ed004fecf3", "is_inferred": false, "labels": [ "arx cipher", "bytecode interpreter", "chacha20", "custom stream cipher", "information stealer", "string obfuscation", "vidar", "virtual machine" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "file--736331e4-3a01-5089-8aed-e85973c53f1b", "type": "StixFile" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-13T12:23:48.870Z", "created_at": "2026-09-13T15:50:55.248Z", "modified": "2026-09-26T18:39:38.457Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:39:38.457Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e84c1064-6cbb-4626-851d-6969217bdd15", "from_id": "e84c1064-6cbb-4626-851d-6969217bdd15", "from_name": null, "from_type": "Indicator", "id": "036cf55f-3c44-40b9-8c6b-666b0b792855", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "relationship--2818f40a-b778-5b12-99b9-579c61d7e4e5", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-13T12:23:48.882Z", "created_at": "2026-09-13T15:50:56.948Z", "modified": "2026-09-26T18:37:48.747Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:37:48.747Z" }, "description_available": false, "entity_type": "based-on", "fromId": "7c27d6fc-2fb2-4897-9b86-0bd714beac6b", "from_id": "7c27d6fc-2fb2-4897-9b86-0bd714beac6b", "from_name": null, "from_type": "Indicator", "id": "0408788a-b780-4f9d-84af-cce83c229be4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "relationship--084ff670-536d-5281-a075-9aaed58e8744", "toId": "cf9a0b09-a025-4843-a359-62b3dc6a6ce2", "to_id": "cf9a0b09-a025-4843-a359-62b3dc6a6ce2", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-23T12:19:56.438Z", "created_at": "2026-08-23T13:30:15.358Z", "modified": "2026-09-26T18:39:02.316Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:39:02.316Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d0123925-33eb-4d96-843b-15ba44dd4ffd", "from_id": "d0123925-33eb-4d96-843b-15ba44dd4ffd", "from_name": null, "from_type": "Indicator", "id": "0fe4494d-806f-42dc-a17f-43b9f666fc9b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "relationship--7d279c75-ad37-578f-a905-329b004488c4", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:52.315Z", "created_at": "2026-09-26T18:39:57.318Z", "modified": "2026-09-26T18:39:57.674Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:39:57.674Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c71fc708-e26c-4dac-b514-b12ca97c79cd", "from_id": "c71fc708-e26c-4dac-b514-b12ca97c79cd", "from_name": null, "from_type": "Indicator", "id": "1545a46e-03fd-4b23-8639-866e033d65e5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "relationship--c43e36a8-6726-5551-bdac-83f0c03a6fb5", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:52.233Z", "created_at": "2026-09-26T18:37:39.268Z", "modified": "2026-09-26T18:37:44.856Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:37:44.856Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c71fc708-e26c-4dac-b514-b12ca97c79cd", "from_id": "c71fc708-e26c-4dac-b514-b12ca97c79cd", "from_name": null, "from_type": "Indicator", "id": "15f4d474-2dc1-4ac5-942c-4a51bf4d37e1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "relationship--9c49c6b1-e631-5b1d-8f05-d9b3a13aaa25", "toId": "f3d77d60-32b4-4c91-82a7-418720d9deb4", "to_id": "f3d77d60-32b4-4c91-82a7-418720d9deb4", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-23T12:19:56.425Z", "created_at": "2026-08-23T13:29:36.173Z", "modified": "2026-09-26T18:39:00.085Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:39:00.085Z" }, "description_available": false, "entity_type": "indicates", "fromId": "74abf3eb-6c0c-417e-aa76-c65fa47b4190", "from_id": "74abf3eb-6c0c-417e-aa76-c65fa47b4190", "from_name": null, "from_type": "Indicator", "id": "185580ca-7c95-451e-a20a-99b181fda2e6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "relationship--a055ee32-e757-5bc6-b907-3ce7943e12be", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:52.279Z", "created_at": "2026-09-26T18:39:24.610Z", "modified": "2026-09-26T18:39:25.887Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:39:25.887Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2e64b5ee-6efb-484f-9c90-bed755a78543", "from_id": "2e64b5ee-6efb-484f-9c90-bed755a78543", "from_name": null, "from_type": "Indicator", "id": "1871dafc-f17e-4259-97cf-f869cef14024", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "relationship--fbc42995-7c55-547a-bd15-19b514d2ffec", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-23T12:19:56.437Z", "created_at": "2026-08-23T13:29:58.484Z", "modified": "2026-09-26T18:37:07.384Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:37:07.384Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d0123925-33eb-4d96-843b-15ba44dd4ffd", "from_id": "d0123925-33eb-4d96-843b-15ba44dd4ffd", "from_name": null, "from_type": "Indicator", "id": "208b093b-e2d3-43b4-b25e-1537c4b0db62", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "relationship--db98f6cf-f7b6-5211-bff4-99dce1b3f1b5", "toId": "1d0d170b-5d1a-4711-8893-21cc120fa924", "to_id": "1d0d170b-5d1a-4711-8893-21cc120fa924", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:52.244Z", "created_at": "2026-09-26T18:38:05.349Z", "modified": "2026-09-26T18:38:19.684Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:38:19.684Z" }, "description_available": false, "entity_type": "based-on", "fromId": "758cafb6-b456-4c98-8af5-397379c6973c", "from_id": "758cafb6-b456-4c98-8af5-397379c6973c", "from_name": null, "from_type": "Indicator", "id": "29f9702b-ca0d-40ae-8ff6-2d41f85e0cdd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "relationship--9e481243-a865-5832-aecd-8eb0e2d98663", "toId": "f5d6f37f-0264-4cb9-a052-97ed004fecf3", "to_id": "f5d6f37f-0264-4cb9-a052-97ed004fecf3", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-13T12:23:48.883Z", "created_at": "2026-09-13T15:50:57.728Z", "modified": "2026-09-26T18:39:49.051Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:39:49.051Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7c27d6fc-2fb2-4897-9b86-0bd714beac6b", "from_id": "7c27d6fc-2fb2-4897-9b86-0bd714beac6b", "from_name": null, "from_type": "Indicator", "id": "302b201c-f68c-4de6-aac2-c36f424904d8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "relationship--91d14583-f09b-5266-bbe7-051156b4c3db", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:52.345Z", "created_at": "2026-09-26T18:40:23.406Z", "modified": "2026-09-26T18:40:23.691Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:40:23.691Z" }, "description_available": false, "entity_type": "indicates", "fromId": "758cafb6-b456-4c98-8af5-397379c6973c", "from_id": "758cafb6-b456-4c98-8af5-397379c6973c", "from_name": null, "from_type": "Indicator", "id": "5bc9a5da-490f-4fe5-8b48-5797597611e4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "relationship--2070367b-38cb-5a0d-b6ee-df7d2a68e174", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:52.237Z", "created_at": "2026-09-26T18:37:45.918Z", "modified": "2026-09-26T18:37:50.709Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:37:50.709Z" }, "description_available": false, "entity_type": "based-on", "fromId": "287a1051-1bb6-44e6-9f59-6f101377fc73", "from_id": "287a1051-1bb6-44e6-9f59-6f101377fc73", "from_name": null, "from_type": "Indicator", "id": "6390cf4d-94b7-4b3b-8ed5-4ac929eabf14", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "relationship--61236ee0-54b6-53ac-8dc9-8b29b3bdf8e3", "toId": "40d65b34-7d96-4152-94cd-68ee5e4582f2", "to_id": "40d65b34-7d96-4152-94cd-68ee5e4582f2", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:52.223Z", "created_at": "2026-09-26T18:37:17.275Z", "modified": "2026-09-26T18:37:28.118Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:37:28.118Z" }, "description_available": false, "entity_type": "based-on", "fromId": "2e64b5ee-6efb-484f-9c90-bed755a78543", "from_id": "2e64b5ee-6efb-484f-9c90-bed755a78543", "from_name": null, "from_type": "Indicator", "id": "63ff119f-ba84-4c57-8b13-8d0143f179e9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "relationship--bdbd4fbf-70d5-5270-b28e-7e11682d9977", "toId": "f347e95e-cb93-4771-a1e0-1715b03da4bb", "to_id": "f347e95e-cb93-4771-a1e0-1715b03da4bb", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:52.220Z", "created_at": "2026-09-26T18:37:06.651Z", "modified": "2026-09-26T18:37:17.211Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:37:17.211Z" }, "description_available": false, "entity_type": "based-on", "fromId": "724dafcc-ca72-4b95-80df-50e74ea5dbd0", "from_id": "724dafcc-ca72-4b95-80df-50e74ea5dbd0", "from_name": null, "from_type": "Indicator", "id": "800c6034-c257-4e3d-a269-7b90a6377174", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "relationship--cdc2232b-9c3e-5d3d-98b4-1cec886eef6f", "toId": "81b854bf-f297-4f3d-a45b-1b13dd94d6a7", "to_id": "81b854bf-f297-4f3d-a45b-1b13dd94d6a7", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 45, "created_by": null, "dates": { "created": "2026-08-23T12:19:56.420Z", "created_at": "2026-08-23T13:29:25.218Z", "modified": "2026-08-23T13:29:27.564Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-08-23T13:29:27.564Z" }, "description_available": false, "entity_type": "based-on", "fromId": "33210948-1360-4560-b195-9d363c8331b0", "from_id": "33210948-1360-4560-b195-9d363c8331b0", "from_name": null, "from_type": "Indicator", "id": "8129f353-2cfe-4fd5-99c0-cc1390a9e197", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "relationship--5852d710-a762-5573-9c9d-25b22be1ae8a", "toId": "81b854bf-f297-4f3d-a45b-1b13dd94d6a7", "to_id": "81b854bf-f297-4f3d-a45b-1b13dd94d6a7", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-23T12:19:56.424Z", "created_at": "2026-08-23T13:29:29.860Z", "modified": "2026-09-26T18:37:10.190Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:37:10.190Z" }, "description_available": false, "entity_type": "based-on", "fromId": "74abf3eb-6c0c-417e-aa76-c65fa47b4190", "from_id": "74abf3eb-6c0c-417e-aa76-c65fa47b4190", "from_name": null, "from_type": "Indicator", "id": "97b16afb-64ea-4880-83f7-d0ea24e99d13", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "relationship--e1471db4-2054-5106-817f-3b01d3ae231e", "toId": "275b90ad-5b26-4263-bfb8-6cdb07e8485a", "to_id": "275b90ad-5b26-4263-bfb8-6cdb07e8485a", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:52.333Z", "created_at": "2026-09-26T18:40:14.749Z", "modified": "2026-09-26T18:40:14.897Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:40:14.897Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c71f78c3-5afa-4841-acad-609accb87504", "from_id": "c71f78c3-5afa-4841-acad-609accb87504", "from_name": null, "from_type": "Indicator", "id": "989de935-fd6f-4542-9e91-e4ef2c4ff632", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "relationship--0c5a204b-5d0d-5615-90a1-d6f13c4cd743", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:52.325Z", "created_at": "2026-09-26T18:40:06.790Z", "modified": "2026-09-26T18:40:07.104Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:40:07.104Z" }, "description_available": false, "entity_type": "indicates", "fromId": "287a1051-1bb6-44e6-9f59-6f101377fc73", "from_id": "287a1051-1bb6-44e6-9f59-6f101377fc73", "from_name": null, "from_type": "Indicator", "id": "9a6946d3-2302-4723-8cc0-30a8e4316b5e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "relationship--b93d172d-5d3c-57ef-ab14-84906f0798f0", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-13T12:23:48.869Z", "created_at": "2026-09-13T15:50:54.700Z", "modified": "2026-09-26T18:37:41.467Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:37:41.467Z" }, "description_available": false, "entity_type": "based-on", "fromId": "e84c1064-6cbb-4626-851d-6969217bdd15", "from_id": "e84c1064-6cbb-4626-851d-6969217bdd15", "from_name": null, "from_type": "Indicator", "id": "a265d43c-9a0e-4f10-9d5d-7225b4d6c0e7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "relationship--fa2ce738-3924-5074-a432-61738ba62cc8", "toId": "bb57e773-95c6-4db2-a80c-20211988f8df", "to_id": "bb57e773-95c6-4db2-a80c-20211988f8df", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:52.241Z", "created_at": "2026-09-26T18:37:49.029Z", "modified": "2026-09-26T18:37:55.841Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:37:55.841Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c71f78c3-5afa-4841-acad-609accb87504", "from_id": "c71f78c3-5afa-4841-acad-609accb87504", "from_name": null, "from_type": "Indicator", "id": "d1340c6b-3de2-465a-9a34-5ad0e74a32ed", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "relationship--b29f1b4e-6a7f-52d7-89cb-7b17465a43e1", "toId": "c004ce0f-d221-40cf-989b-53145f8df99e", "to_id": "c004ce0f-d221-40cf-989b-53145f8df99e", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:52.268Z", "created_at": "2026-09-26T18:39:12.095Z", "modified": "2026-09-26T18:39:12.413Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:39:12.413Z" }, "description_available": false, "entity_type": "indicates", "fromId": "724dafcc-ca72-4b95-80df-50e74ea5dbd0", "from_id": "724dafcc-ca72-4b95-80df-50e74ea5dbd0", "from_name": null, "from_type": "Indicator", "id": "e29cdcef-f5df-4949-a1a1-6a47d8c81bf0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "relationship--7205c9d5-4c5d-573f-9330-31126721e492", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 45, "created_by": null, "dates": { "created": "2026-09-13T12:23:48.865Z", "created_at": "2026-09-13T15:50:52.709Z", "modified": "2026-09-13T15:50:54.033Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-13T15:50:54.033Z" }, "description_available": false, "entity_type": "based-on", "fromId": "4efc8e66-b1d4-480a-acff-32e729664e4e", "from_id": "4efc8e66-b1d4-480a-acff-32e729664e4e", "from_name": null, "from_type": "Indicator", "id": "fe982ca1-e6f2-484c-9fee-8d26b42ad52a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "relationship--a232226d-1dcd-5665-a976-cab74a44eacf", "toId": "f347e95e-cb93-4771-a1e0-1715b03da4bb", "to_id": "f347e95e-cb93-4771-a1e0-1715b03da4bb", "to_name": null, "to_type": "StixFile" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "03f13619a413dd1bd7ff8dd47687b3e9", "description_available": false, "object_id": "e84c1064-6cbb-4626-851d-6969217bdd15", "object_ids": [ "bb57e773-95c6-4db2-a80c-20211988f8df", "e84c1064-6cbb-4626-851d-6969217bdd15" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "e84c1064-6cbb-4626-851d-6969217bdd15", "valid_from": "2026-09-13T12:23:48.867Z", "valid_until": "2027-06-30T23:33:33.424Z", "validity_status": "active", "value": "03f13619a413dd1bd7ff8dd47687b3e9" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "bb57e773-95c6-4db2-a80c-20211988f8df", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "03f13619a413dd1bd7ff8dd47687b3e9" } ], "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "type": "md5", "valid_from": "2026-09-13T12:23:48.867Z", "valid_until": "2027-06-30T23:33:33.424Z", "validity_status": "active", "value": "03f13619a413dd1bd7ff8dd47687b3e9" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "16addb6524e5cf76f4114b0979f715ff", "description_available": false, "object_id": "74abf3eb-6c0c-417e-aa76-c65fa47b4190", "object_ids": [ "275b90ad-5b26-4263-bfb8-6cdb07e8485a", "74abf3eb-6c0c-417e-aa76-c65fa47b4190" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "74abf3eb-6c0c-417e-aa76-c65fa47b4190", "valid_from": "2026-08-23T12:19:56.422Z", "valid_until": "2027-06-09T23:29:40.979Z", "validity_status": "active", "value": "16addb6524e5cf76f4114b0979f715ff" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "275b90ad-5b26-4263-bfb8-6cdb07e8485a", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "16addb6524e5cf76f4114b0979f715ff" } ], "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "type": "md5", "valid_from": "2026-08-23T12:19:56.422Z", "valid_until": "2027-06-09T23:29:40.979Z", "validity_status": "active", "value": "16addb6524e5cf76f4114b0979f715ff" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "a2535f051c329131c107d14651ace793", "description_available": false, "object_id": "c71fc708-e26c-4dac-b514-b12ca97c79cd", "object_ids": [ "c71fc708-e26c-4dac-b514-b12ca97c79cd", "f3d77d60-32b4-4c91-82a7-418720d9deb4" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "c71fc708-e26c-4dac-b514-b12ca97c79cd", "valid_from": "2026-09-21T16:45:51.000Z", "valid_until": "2027-07-09T03:55:35.557Z", "validity_status": "active", "value": "a2535f051c329131c107d14651ace793" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "f3d77d60-32b4-4c91-82a7-418720d9deb4", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "a2535f051c329131c107d14651ace793" } ], "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "type": "md5", "valid_from": "2026-09-21T16:45:51.000Z", "valid_until": "2027-07-09T03:55:35.557Z", "validity_status": "active", "value": "a2535f051c329131c107d14651ace793" }, { "classification": "indicator", "confidence": null, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "37ee3afa9df9c7d65b780cf54e908a98b92c4a5b", "description_available": false, "object_id": "2e64b5ee-6efb-484f-9c90-bed755a78543", "object_ids": [ "2e64b5ee-6efb-484f-9c90-bed755a78543", "4efc8e66-b1d4-480a-acff-32e729664e4e", "f347e95e-cb93-4771-a1e0-1715b03da4bb" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "2e64b5ee-6efb-484f-9c90-bed755a78543", "valid_from": "2026-09-21T16:45:51.000Z", "valid_until": "2027-07-09T03:55:35.557Z", "validity_status": "active", "value": "37ee3afa9df9c7d65b780cf54e908a98b92c4a5b" }, { "classification": "indicator", "confidence": 45, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "4efc8e66-b1d4-480a-acff-32e729664e4e", "valid_from": "2026-09-13T12:23:48.862Z", "valid_until": "2027-06-30T23:33:33.419Z", "validity_status": "active", "value": "37ee3afa9df9c7d65b780cf54e908a98b92c4a5b" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "f347e95e-cb93-4771-a1e0-1715b03da4bb", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "37ee3afa9df9c7d65b780cf54e908a98b92c4a5b" } ], "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "type": "sha1", "valid_from": null, "valid_until": null, "validity_status": "active", "value": "37ee3afa9df9c7d65b780cf54e908a98b92c4a5b" }, { "classification": "indicator", "confidence": null, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "91c3431e51158aa800a452222a2404d7b82631ea", "description_available": false, "object_id": "33210948-1360-4560-b195-9d363c8331b0", "object_ids": [ "33210948-1360-4560-b195-9d363c8331b0", "724dafcc-ca72-4b95-80df-50e74ea5dbd0", "81b854bf-f297-4f3d-a45b-1b13dd94d6a7" ], "source_objects": [ { "classification": "indicator", "confidence": 45, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "33210948-1360-4560-b195-9d363c8331b0", "valid_from": "2026-08-23T12:19:56.418Z", "valid_until": "2027-06-09T23:29:40.975Z", "validity_status": "active", "value": "91c3431e51158aa800a452222a2404d7b82631ea" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "724dafcc-ca72-4b95-80df-50e74ea5dbd0", "valid_from": "2026-09-21T16:45:51.000Z", "valid_until": "2027-07-09T03:55:35.557Z", "validity_status": "active", "value": "91c3431e51158aa800a452222a2404d7b82631ea" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "81b854bf-f297-4f3d-a45b-1b13dd94d6a7", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "91c3431e51158aa800a452222a2404d7b82631ea" } ], "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "type": "sha1", "valid_from": null, "valid_until": null, "validity_status": "active", "value": "91c3431e51158aa800a452222a2404d7b82631ea" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "eb2a38a90d20475b00bdc285b89eb50eefd0b88e", "description_available": false, "object_id": "287a1051-1bb6-44e6-9f59-6f101377fc73", "object_ids": [ "287a1051-1bb6-44e6-9f59-6f101377fc73", "40d65b34-7d96-4152-94cd-68ee5e4582f2" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "287a1051-1bb6-44e6-9f59-6f101377fc73", "valid_from": "2026-09-21T16:45:51.000Z", "valid_until": "2027-07-09T03:55:35.557Z", "validity_status": "active", "value": "eb2a38a90d20475b00bdc285b89eb50eefd0b88e" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "40d65b34-7d96-4152-94cd-68ee5e4582f2", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "eb2a38a90d20475b00bdc285b89eb50eefd0b88e" } ], "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "type": "sha1", "valid_from": "2026-09-21T16:45:51.000Z", "valid_until": "2027-07-09T03:55:35.557Z", "validity_status": "active", "value": "eb2a38a90d20475b00bdc285b89eb50eefd0b88e" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "1628bb03db87f67661349e169d73ee14ed490bdbf22abfbda08ccc9ebe237974", "description_available": false, "object_id": "c71f78c3-5afa-4841-acad-609accb87504", "object_ids": [ "c004ce0f-d221-40cf-989b-53145f8df99e", "c71f78c3-5afa-4841-acad-609accb87504" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "c71f78c3-5afa-4841-acad-609accb87504", "valid_from": "2026-09-21T16:45:51.000Z", "valid_until": "2027-07-09T03:55:35.557Z", "validity_status": "active", "value": "1628bb03db87f67661349e169d73ee14ed490bdbf22abfbda08ccc9ebe237974" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "c004ce0f-d221-40cf-989b-53145f8df99e", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "1628bb03db87f67661349e169d73ee14ed490bdbf22abfbda08ccc9ebe237974" } ], "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "type": "sha256", "valid_from": "2026-09-21T16:45:51.000Z", "valid_until": "2027-07-09T03:55:35.557Z", "validity_status": "active", "value": "1628bb03db87f67661349e169d73ee14ed490bdbf22abfbda08ccc9ebe237974" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "2d43d592630ad1e012da63ef7279f95dd4a8e94964e12ca2f996051875574fa6", "description_available": false, "object_id": "d0123925-33eb-4d96-843b-15ba44dd4ffd", "object_ids": [ "1d0d170b-5d1a-4711-8893-21cc120fa924", "d0123925-33eb-4d96-843b-15ba44dd4ffd" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "d0123925-33eb-4d96-843b-15ba44dd4ffd", "valid_from": "2026-08-23T12:19:56.435Z", "valid_until": "2027-06-09T23:29:40.992Z", "validity_status": "active", "value": "2d43d592630ad1e012da63ef7279f95dd4a8e94964e12ca2f996051875574fa6" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "1d0d170b-5d1a-4711-8893-21cc120fa924", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "2d43d592630ad1e012da63ef7279f95dd4a8e94964e12ca2f996051875574fa6" } ], "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "type": "sha256", "valid_from": "2026-08-23T12:19:56.435Z", "valid_until": "2027-06-09T23:29:40.992Z", "validity_status": "active", "value": "2d43d592630ad1e012da63ef7279f95dd4a8e94964e12ca2f996051875574fa6" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "625a381981fc2d4c25c981d98b1d66bb2cf5da2dde2f590add0673a857d5b074", "description_available": false, "object_id": "758cafb6-b456-4c98-8af5-397379c6973c", "object_ids": [ "758cafb6-b456-4c98-8af5-397379c6973c", "f5d6f37f-0264-4cb9-a052-97ed004fecf3" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "758cafb6-b456-4c98-8af5-397379c6973c", "valid_from": "2026-09-21T16:45:51.000Z", "valid_until": "2027-07-09T03:55:35.557Z", "validity_status": "active", "value": "625a381981fc2d4c25c981d98b1d66bb2cf5da2dde2f590add0673a857d5b074" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "f5d6f37f-0264-4cb9-a052-97ed004fecf3", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "625a381981fc2d4c25c981d98b1d66bb2cf5da2dde2f590add0673a857d5b074" } ], "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "type": "sha256", "valid_from": "2026-09-21T16:45:51.000Z", "valid_until": "2027-07-09T03:55:35.557Z", "validity_status": "active", "value": "625a381981fc2d4c25c981d98b1d66bb2cf5da2dde2f590add0673a857d5b074" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "979048a749d8f28d877c7068b1b336ecd1e349869dfb1d7c68118f90e4099bc4", "description_available": false, "object_id": "7c27d6fc-2fb2-4897-9b86-0bd714beac6b", "object_ids": [ "7c27d6fc-2fb2-4897-9b86-0bd714beac6b", "cf9a0b09-a025-4843-a359-62b3dc6a6ce2" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "7c27d6fc-2fb2-4897-9b86-0bd714beac6b", "valid_from": "2026-09-13T12:23:48.880Z", "valid_until": "2027-06-30T23:33:33.437Z", "validity_status": "active", "value": "979048a749d8f28d877c7068b1b336ecd1e349869dfb1d7c68118f90e4099bc4" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "cf9a0b09-a025-4843-a359-62b3dc6a6ce2", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "979048a749d8f28d877c7068b1b336ecd1e349869dfb1d7c68118f90e4099bc4" } ], "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "type": "sha256", "valid_from": "2026-09-13T12:23:48.880Z", "valid_until": "2027-06-30T23:33:33.437Z", "validity_status": "active", "value": "979048a749d8f28d877c7068b1b336ecd1e349869dfb1d7c68118f90e4099bc4" } ], "mentioned": [ { "confidence": 50, "evidence_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "name": "Vidar", "role": "mentionné", "type": "Malware" } ], "mitre": { "associated_repertoire": [ { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-03-18T09:18:14.122Z", "created_at": "2026-04-25T00:38:20.225Z", "modified": "2026-04-25T00:38:21.265Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-25T00:38:21.265Z" }, "description_available": false, "entity_type": "uses", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "334a86e6-dc29-406b-84c2-e3261979d682", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "relationship--6850c2c3-7162-5383-97d2-3f3dc4caaaf6", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T18:42:00.164Z", "created_at": "2026-03-02T16:49:03.508Z", "modified": "2026-03-02T16:49:03.837Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-02T16:49:03.837Z" }, "description_available": false, "entity_type": "uses", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "be45da20-8023-4cab-856b-6dbf1f622fd5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "relationship--284446b2-7eab-5252-b491-15312ee64d78", "toId": "ec63d43c-303b-401d-acf2-f69282aa385f", "to_id": "ec63d43c-303b-401d-acf2-f69282aa385f", "to_name": "T1022", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:12:47.725Z", "created_at": "2026-03-07T15:38:03.133Z", "modified": "2026-03-07T15:38:03.525Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-07T15:38:03.525Z" }, "description_available": false, "entity_type": "uses", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "e227e9db-8b50-4dc4-a86b-91d94636e45b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "relationship--85a9df8e-c237-5220-a00b-7145d6bfe0c4", "toId": "377ba555-5dfd-4322-a9c5-4ccce578b698", "to_id": "377ba555-5dfd-4322-a9c5-4ccce578b698", "to_name": "T1107", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T18:18:00.990Z", "created_at": "2026-02-26T14:25:11.326Z", "modified": "2026-02-26T14:25:13.130Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-02-26T14:25:13.130Z" }, "description_available": false, "entity_type": "uses", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "e40da663-79dd-43d3-911a-b02e2f2a7352", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "standard_id": "relationship--1fd2087a-c237-5e58-80e2-4d31fa00722b", "toId": "37cb988d-0793-44f1-9c02-4a4c073a2f65", "to_id": "37cb988d-0793-44f1-9c02-4a4c073a2f65", "to_name": "TA0037", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1107" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:04:28.700Z", "created_by": null, "dates": { "created": "2026-01-18T18:04:28.700Z", "created_at": "2026-01-18T22:33:04.084Z", "modified": "2026-01-18T22:33:05.539Z", "updated_at": "2026-01-18T22:33:05.539Z" }, "description_available": false, "evidence_ids": [ "377ba555-5dfd-4322-a9c5-4ccce578b698", "e227e9db-8b50-4dc4-a86b-91d94636e45b" ], "external_id": "T1107", "id": "377ba555-5dfd-4322-a9c5-4ccce578b698", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1107", "modified": "2026-01-18T22:33:05.539Z", "name": "T1107", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1107", "id": "2fe56096-4b6c-4e42-9d04-6696e9f57d48", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1107" } ], "relationship_ids": [ "e227e9db-8b50-4dc4-a86b-91d94636e45b" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "tactics": [], "url": "https://attack.mitre.org/techniques/T1107/", "via_entities": [ { "id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "name": "Vidar", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "TA0037" }, "authorized_members": [], "confidence": 50, "created": "2026-01-19T17:54:05.897Z", "created_by": null, "dates": { "created": "2026-01-19T17:54:05.897Z", "created_at": "2026-02-22T11:56:32.763Z", "modified": "2026-02-22T11:56:33.001Z", "updated_at": "2026-02-22T11:56:33.001Z" }, "description_available": false, "evidence_ids": [ "37cb988d-0793-44f1-9c02-4a4c073a2f65", "e40da663-79dd-43d3-911a-b02e2f2a7352" ], "external_id": null, "id": "37cb988d-0793-44f1-9c02-4a4c073a2f65", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": null, "modified": "2026-02-22T11:56:33.001Z", "name": "TA0037", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "TA0037", "id": "d76e185f-fd09-4036-a538-7c4307ef3ae4", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/TA0037" } ], "relationship_ids": [ "e40da663-79dd-43d3-911a-b02e2f2a7352" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "tactics": [], "url": null, "via_entities": [ { "id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "name": "Vidar", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "334a86e6-dc29-406b-84c2-e3261979d682", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "334a86e6-dc29-406b-84c2-e3261979d682" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "name": "Vidar", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1022" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:06:14.577Z", "created_by": null, "dates": { "created": "2026-01-18T18:06:14.577Z", "created_at": "2026-01-19T06:44:21.850Z", "modified": "2026-01-19T06:44:22.697Z", "updated_at": "2026-01-19T06:44:22.697Z" }, "description_available": false, "evidence_ids": [ "be45da20-8023-4cab-856b-6dbf1f622fd5", "ec63d43c-303b-401d-acf2-f69282aa385f" ], "external_id": "T1022", "id": "ec63d43c-303b-401d-acf2-f69282aa385f", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1022", "modified": "2026-01-19T06:44:22.697Z", "name": "T1022", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1022", "id": "9aae6d73-a71c-4f60-bb5a-233ac9db913a", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1022" } ], "relationship_ids": [ "be45da20-8023-4cab-856b-6dbf1f622fd5" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation", "tactics": [], "url": "https://attack.mitre.org/techniques/T1022/", "via_entities": [ { "id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "name": "Vidar", "type": "Malware" } ] } ], "via_entity": { "id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "name": "Vidar", "type": "Malware" } } ], "direct_techniques": [], "official_catalog": { "complete": true, "fetched_at": "2026-10-10T19:50:10Z", "schema_version": 1, "source_sha256": "6227cd8ff0e21fc6355dc871dcad6a354b0d36570d2c3b783667577320378730", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack.json", "techniques": [ { "attack_version": "1.1", "canonical_url": "https://attack.mitre.org/techniques/T1022/", "created": "2017-05-31T21:30:30.260Z", "deprecated": false, "matched": true, "mitre_id": "T1022", "modified": "2025-10-24T17:49:27.757Z", "official_name": "Data Encrypted", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0010", "name": "Exfiltration", "shortname": "exfiltration" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1560/", "mitre_id": "T1560", "official_name": "Archive Collected Data", "official_status": "active", "relationship_id": "relationship--96f5f245-a67b-4e3d-8d3f-ef2a7719a3fd", "stix_id": "attack-pattern--53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a" } ], "revoked": true, "stix_id": "attack-pattern--d54416bd-0803-41ca-870a-ce1af7c05638" }, { "attack_version": "1.1", "canonical_url": "https://attack.mitre.org/techniques/T1107/", "created": "2017-05-31T21:31:17.915Z", "deprecated": false, "matched": true, "mitre_id": "T1107", "modified": "2026-04-14T22:53:14.915Z", "official_name": "File Deletion", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0005", "name": "Stealth", "shortname": "stealth" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1070/004/", "mitre_id": "T1070.004", "official_name": "File Deletion", "official_status": "active", "relationship_id": "relationship--f6514d17-d599-4a45-93b2-a80b4aa39dde", "stix_id": "attack-pattern--d63a3fb8-9452-4e9d-a60a-54be68d5998c" } ], "revoked": true, "stix_id": "attack-pattern--56fca983-1cf1-4fd1-bda0-5e170a37ab59" }, { "attack_version": "2.1", "canonical_url": "https://attack.mitre.org/techniques/T1574/002/", "created": "2020-03-13T19:41:37.908Z", "deprecated": false, "matched": true, "mitre_id": "T1574.002", "modified": "2026-04-15T22:56:43.434Z", "official_name": "DLL Side-Loading", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0002", "name": "Execution", "shortname": "execution" }, { "mitre_id": "TA0005", "name": "Stealth", "shortname": "stealth" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1574/001/", "mitre_id": "T1574.001", "official_name": "DLL", "official_status": "active", "relationship_id": "relationship--7bb3a367-c3fd-4981-8d95-8ba142f92cf2", "stix_id": "attack-pattern--2fee9321-3e71-4cf4-af24-d4d40d355b34" } ], "revoked": true, "stix_id": "attack-pattern--e64c62cf-9cd7-4a14-94ec-cdaac43ab44b" } ] } }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-21T16:45:51.156Z", "created_at": "2026-09-26T18:40:32.496Z", "modified": "2026-09-26T18:40:39.840Z", "published": "2026-09-21T16:45:51.156Z", "updated_at": "2026-09-26T18:40:39.840Z" }, "description_available": true, "id": "4713813c-da73-4c6b-9e7c-8ae320df74cb", "is_inferred": false, "labels": [ "arx cipher", "bytecode interpreter", "chacha20", "custom stream cipher", "information stealer", "string obfuscation", "vidar", "virtual machine" ], "lang": "en", "name": "Vidar Adds Virtual Machine and Custom Stream Ciphers For String Obfuscation", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-09-21T16:45:51.156Z", "references": [ { "external_id": "6ab15f3f1d05b3fb6ae23973", "id": "3cd6ea26-c52a-4e6c-9f7b-9c0504c8e67a", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6ab15f3f1d05b3fb6ae23973" }, { "external_id": null, "id": "9bb7bd95-75d4-41f7-9861-c65b553f24d4", "source_name": "malpedia", "url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation" }, "targets": [], "techniques": [], "vulnerabilities": [] }, "report_id": "4713813c-da73-4c6b-9e7c-8ae320df74cb", "schema_version": 1, "selected_date": "2026-09-21", "source_url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation" }