Vidar Custom VM/Cipher Polymorphic Obfuscation Heuristic

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•2

Detects Vidar Infostealer variants by identifying its unique per-build polymorphic virtual machine bytecode interpreter and custom ARX stream cipher. The rule uses a combination of high file entropy, lack of standard OS cryptographic API imports, and the presence of structurally invariant indirect jump-table dispatch patterns used in custom VM execution loops.