Vidar Stealer malware

Vidar is an information stealer derived from the Arkei family. It steals browser data, wallets and files, and retrieves its C2 addresses through dead-drop resolvers on public platforms.

Malva.RE has analysed 322 public samples tagged Vidar Stealer, statically and without execution. The latest public sample was seen on 2026-09-29.

File types

PE Executable37
HTML2
VBScript1

Latest public Vidar Stealer samples

Sample	Type	First seen
39c8c95325a5a1cb68805af3f1aa181a6120fe0732276f43dc309bbe8332c0b1	VBScript	2026-09-29
994e3908823894f612b5081094f2e398f9855bc91297c06182f8a2cee0803484	PE Executable	2026-09-29
790a90d32a32e76918851d26c854ef6af63c172c6bbb1f32b70249f451f11c4b	PE Executable	2026-09-29
b083df8c6bc1f8129547a16b1d0636d81761ab9829fe523add12486196c9c4bd	PE Executable	2026-09-26
379f067cc2b638ceb07b704e5cd17fcc9c83bd167a3011f4362d7d2de960580b	PE Executable	2026-09-26
9522a0347222b4a2a4adfed4670f0cc99ea4fb6c7ddcd017293fbc29829995bc arena-1v1.exe	PE Executable	2026-09-25
ab639d365b794c5f8e84f87f3f3db870e0e5cd5b57f64c48308a44999ff73f52 game10-aeon.exe	PE Executable	2026-09-25
eb62e1c646d0e5f3ddd0ab11685ce6ecf36d56bd3d3150c235294b2e3f00427a	PE Executable	2026-09-25
673fa832a33c632001bbb8f97a9e74d9715fff9cc3ab4ed315887449743f8537	PE Executable	2026-09-25
28aa847e3864a8d6a71a30479105fdf8dfca667831735e4e4e621031d723049a	PE Executable	2026-09-25
2d2955b4c926b32e994a17421d8515803e00a768730d6f5eb7fb946dacc805a7	PE Executable	2026-09-25
26044fb6c00476d27aaafee474caf8be9dd7fbd696b8c0d63743bd3344d2e27b	PE Executable	2026-09-25
c5b47b6fb38693695b05ccabc05abb68ca5a620590eaf068c93da0f7f03bd66a	HTML	2026-09-25
68ba057e17157ef33b19df99a1c9556c6c7f04bb2ce43b628bb8a62bbc6ec692	HTML	2026-09-25
b2a7b0c07e3a902568c0688376632221f696dfad34de120a821c4d4b7666aa88	PE Executable	2026-09-25
0495b02f2be255022bc9c227d9c217ddb30bd7e9a853311197bc32d803f56e50	PE Executable	2026-09-25
83075e6f511d4b63e5bbeabd397321a77b80bbf3521c708cbc96587a4d0091ab	PE Executable	2026-09-25
8eefa76b366f84df2e08c65604263041e28734e4feb335f29e78932ffee81466	PE Executable	2026-09-24
69d1133ebbf80d6e14b2d584f3390717d3c490fe3df2d6a40fc57bada76d3923	PE Executable	2026-09-24
9b0050d44e7ea5b1d612ce396c70e7c789342f00b07980e5f8dfed4506516b2f	PE Executable	2026-09-24
2823619d9775c348c53807e986feee0c6862ee7350e2d0e4edc6954b2de73c02	PE Executable	2026-09-23
1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25	PE Executable	2026-09-23
c0448ee6790d9b3159b4f7557f351cca7c310144d187aef8ce8b2fea7deaca1b	PE Executable	2026-09-23
6610a658f8064a9c5d238fe9fa376db2e409a302a8c4f52c0fd3577a727fbf23	PE Executable	2026-09-23
c8beb8ee245bbcae97cdb5d738eb25e1d0e0ee20371cbb9db38b5f1b4da1da26	PE Executable	2026-09-22
617739f264479ff970bd61c77cade4750fa49ecb82f1104c91c5a6bce197426b	PE Executable	2026-09-22
6540089b451cdaf6d29e7b44cd7c8666ca86187b1c6aec12de2976547814b733	PE Executable	2026-09-22
993ab6888be9990b409d9ff41309719a6eff5a2f163c3dfb60cdc1070d013d2a	PE Executable	2026-09-22
800e772f537565970a4d0873a91e631f0a74ebc354485df30e82865053ea2966	PE Executable	2026-09-22
7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74	PE Executable	2026-09-22
0071a891148bb7ef7c17e5a1b7caf2119613fc0a7ae1cdc898e8dd0ac5f00e51	PE Executable	2026-09-21
00219a6c610d02c63721e8521c70c9086fdbf566205dcac489f1904f11377218	PE Executable	2026-09-21
f51bd6b15fa0908f2996bbecdaaf7571a578a8d22df7a99c34b420b630fb8ac3	PE Executable	2026-09-21
e412a1e9c8de8d806cc27ab46974609dd0526b6591c08cd5b83d61ee52a0485d	PE Executable	2026-09-20
19fcf0739788f7f96ebcbe9d2800363e581215595e82b5c85776a042a408b704	PE Executable	2026-09-20
aba7778d25f569377be922392bc03b3b8faacabeb7e2844acd9f7d0c2d4bc433	PE Executable	2026-09-20
6cb5a0ab36d498d077f1acb41cfcf1c5f065bb995122e87889aa27ddc3735e4d	PE Executable	2026-09-20
cd1a31628c7872c86f7ec22d5729d2c47e8b3a0cdcfbcd2d719cb8e2728b56f9	PE Executable	2026-09-20
1ab6782e44c69df2ce8a5e9e5f784a7e3a50fb157d185bf4dabfba0ab2ad70c4	PE Executable	2026-09-20
795f9caf051b0d3e6199e78fd5af4f92b13ea5bbdeba9d7e9aa58dddf1e8433e	PE Executable	2026-09-20

Analyse your own Vidar Stealer sample

Malva.RE unpacks, decompiles and extracts the configuration of suspicious files statically — the file is never executed. Free-plan reports are public.

Analyse a file for free