Actor / Malware Family
Vidar Stealer
2 queries tagged with this actor.
-
Analytics Rules
Detect Dll Masquerading As Microsoft Defender
DLLs pretending to be Microsoft Defender via resource-level publisher/original-filename metadata — a Vidar Stealer TTP.
-
Hunting
Hunt Inflated File Payload Evading Size Based Av Scan
File downloads anomalously large for their kind — Vidar's null-byte padding trick to slip past AV scanners that skip files above a size ceiling.