Windows_Trojan_Vidar_0f323538

rule Windows_Trojan_Vidar_0f323538 {
    meta:
        author = "Elastic Security"
        id = "0f323538-d789-4480-9b10-db31e0a18790"
        fingerprint = "52039ef9b44bbe4a6594d4efdf20a124a13133e30bb8788978baf2fcd30013e4"
        creation_date = "2026-03-16"
        last_modified = "2026-05-05"
        threat_name = "Windows.Trojan.Vidar"
        reference_sample = "aae5335b89c8655cffbd9e2e8de1726be6bc38e68dcbb048aabb03a2012640aa"
        severity = 100
        arch_context = "x86"
        scan_context = "memory"
        license = "Elastic License v2"
        os = "windows"
    strings:
        $steam = "steamcommunity.com/profiles/"
        $telegram = "telegram.me/"
        $hwid = "Content-Disposition: form-data; name=\"hwid\""
        $browser2 = "\\IndexedDB\\chrome-extension__0.indexeddb.leveldb"
        $browser4 = "\"encrypted_key\":\""
        $c1 = "information.txt"
        $pipe = "\\\\.\\pipe\\test"
        $telemetry1 = "\\telemetry.b64"
    condition:
        all of them
}