TF-2020152
high
📛 Threat Title
Vidar: Domain that is used for botnet Command&control (C&C) ud.amanlay.org
Description
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-11-08 05:05:34 UTC. Last seen: 2026-11-08 06:00:34 UTC. Reporter: crep1x. Tags: Vidar.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
ud.amanlay.org
UrlVoid 1 / 36
IOC database
- Type
- domain
- Value
ud.amanlay.org- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain that is used for botnet Command&control (C&C) attributed to Vidar
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-11-08 05:05:34 UTC. Last seen: 2026-11-08 06:00:34 UTC. Reporter: crep1x. Tags: Vidar.
Remediations (10)
-
web:attack.mitre.org
Vidar Vidar is a Windows infostealer that was first advertised in November 2018. Written in C++, Vidar collects PII, cryptocurrency wallets, documents and other data within the compromised machine. Version 2 of Vidar was published in October 2025, and has been used in numerous operations since its release.
-
web:cybersecuritynews.com
Vidar focuses on pulling information that can be converted into financial gain or used to access other systems. Once the loader completes its work and the payload runs, the malware targets browser-stored credentials, saved session cookies, cryptocurrency wallet files, and general system data.
-
web:gbhackers.com
This file extension masquerading allows the malicious script to bypass basic security controls and execute embedded commands within the user space without raising immediate alarms. Vidar Infostealer Campaign Steals Passwords Before dropping its final payload, the malware actively maps the local environment to avoid detection.
-
web:research.splunk.com
Security teams can use these analytics to identify early-stage Vidar compromise, isolate affected hosts, and prevent credential exfiltration to attacker-controlled command-and-control infrastructure.
-
web:socprime.com
The campaign also relies on Telegram and Cloudflare-fronted domains for command-and-control and data exfiltration. Investigation Point Wild researchers traced the full infection chain from the initial Go-compiled dropper to the final Vidar payload, documenting each layer of obfuscation along the way.
-
web:www.hhs.gov
Vidar frequently uses social media as part of its command and control (C2) infrastructure. The IP address of the C2 infrastructure will be embedded in a user profile on platforms like Mastodon, Telegram, etc. The malware can access this profile, contact the indicated IP address, and download configuration files, instructions, and other malware.
-
web:www.intrinsec.com
Figure 3: Vidar main domain inside "information.txt". The specific "reg" subdomain is a login and registration panel for clients of the stealer.
-
web:www.malwarebytes.com
We found fake "verify you are human" pages on hacked WordPress sites that trick Windows users into installing the Vidar infostealer.
-
web:www.pointwild.com
Initial Infection Vector for Vidar (2026) The initial infection vector for Vidar infostealer in 2026 has significantly evolved from traditional exploit-based delivery to highly user-driven and social engineering-based execution chains.
-
web:www.quorumcyber.com
Executive Summary • Vidar is a strain of "information stealer", or "infostealer", malware, compiled in C++, which collects personal information, private documents, and account data from the devices of infected users. The malware itself is either a fork, or evolution of, the "Arkei" malware variant. Moreover, Vidar malware can be obtained as a "Malware-as-a-Service (MaaS ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.