Vidar Virtual Machine-Based String Obfuscation

This report provides a technical analysis of Vidar malware’s string deobfuscation: a simple bytecode virtual machine (with a per-build XOR seed, 14 handlers, and accumulator-based operations) and two custom stream ciphers (a modified ChaCha variant in v2.0–2.1 and an ARX-based cipher from v2.2 onward). It documents VM opcodes and operations, how keys and nonces are derived from VM output, the ARX keystream generation and folding into bytes, and includes multiple bytecode/ciphertext examples with resulting decrypted strings.