Vidar Stealer ARX stream cipher constants (FNV-1a/golden-ratio + keystream)

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•2

Detects the custom ARX-based stream cipher used by Vidar Stealer (v2.2+) to encrypt strings and configuration data. The rule identifies the presence of specific FNV-1a and golden-ratio constants used for state initialization, in combination with unique, per-build keystream constants observed in recent variants.