Vidar - Zip Archive Exfiltration (T1560.001)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•2

Hunts for the malware compressing the collected host and browser data into a temporary .zip file prior to network exfiltration. Specifically looks for file creation events of .zip files with a specific naming convention (8-15 alphanumeric characters) in common temporary directories, initiated by 'AutoIt3.exe'.