Vidar v2.0+ ARX Stream Cipher Constants (FNV-1a + Golden Ratio)

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•3

This rule detects the presence of Vidar Stealer version 2.0+ by identifying the specific ARX-based (Addition-Rotation-XOR) stream cipher implementation. The detection logic searches for stable cryptographic constants (FNV-1a prime and golden-ratio constants), unique per-build ARX transformation constants, and specific post-decryption artifacts in the file's binary content.