Vidar SQLite Credential Staging with Wallet Directory Probing in Temp

Ibrahim Saud@tektrix

•updated Jul 3, 2026•2•0•4

Detects a process creating SQLite-style database files with random hex-like names within a randomly named subfolder of the Windows %TEMP% directory. This behavior, when correlated with file system access to specific cryptocurrency wallet directories (Electrum, Exodus, Ethereum, Coinomi), is consistent with Vidar information stealer staging activity.