TF-1932796
high
📛 Threat Title
Vidar: URL that is used for botnet Command&control (C&C) https://nu.234-e.com/
Description
Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-09-25 11:20:46 UTC. Last seen: 2026-09-25 12:14:58 UTC. Reporter: crep1x. Tags: Vidar.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
url
https://nu.234-e.com/
UrlVoid 4 / 36
IOC database
- Type
- url
- Value
https://nu.234-e.com/- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- URL that is used for botnet Command&control (C&C) attributed to Vidar
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-09-25 11:20:46 UTC. Last seen: 2026-09-25 11:30:46 UTC. Reporter: crep1x. Tags: Vidar.
Remediations (10)
-
web:cybersecuritynews.com
Vidar stealer evolves its code to evade detection while stealing passwords, cookies, wallet data, and system details from victims.
-
web:securityarsenal.com
This progression matters because Vidar's entire post-exploitation logic — C2 addresses, targeted browser paths, wallet locations, and exfiltration endpoints — lives inside obfuscated strings. By moving decryption into a bespoke VM, the operators have effectively blinded static analysis pipelines, automated sandbox string extraction, and a large class of signature-based detection that ...
-
web:www.acronis.com
Vidar is an infostealer that harvests credentials to enable initial access brokers and ransomware crews. Read our complete guide to Vidar defense.
-
web:www.bsi.bund.de
Additionally, Vidar is often used to download additional malware, such as ransomware. How did I get infected with Vidar ? Vidar typically infects computers via malicious downloads and email attachments. Cybercriminals often send fake invoices, software updates or installers (e.g. ISO/ZIP files or Office documents with macros) that contain Vidar .
-
web:www.censys.com
Vidar Operational Details Vidar uses common network communication methods, and once in place, it will connect to a Telegram server to fetch the URL of the Command and Control (C2) server. In the following two screenshots, you will see examples of this C2 distribution method via Telegram or, if that fails, a backup Steam account.
-
web:www.checkpoint.com
Vidar is an infostealer malware that can also be used to deliver additional forms of malware. Some of the ways that an organization can protect against this malware threat include the following: Employee Training: Vidar is commonly distributed via phishing emails or fake downloads of legitimate software, which actually deliver the malware.
-
web:www.huntress.com
Vidar malware is an information-stealing trojan that targets sensitive data, such as login credentials and cryptocurrency wallets. It works by deploying a payload to infected systems, collecting data, and transmitting it to command and control servers controlled by attackers.
-
web:www.malwarebytes.com
We found fake "verify you are human" pages on hacked WordPress sites that trick Windows users into installing the Vidar infostealer.
-
web:www.pointwild.com
Initial Infection Vector for Vidar (2026) The initial infection vector for Vidar infostealer in 2026 has significantly evolved from traditional exploit-based delivery to highly user-driven and social engineering-based execution chains.
-
web:www.quorumcyber.com
Vidar is a strain of "information stealer", or "infostealer", malware, compiled in C++, which collects personal information, private documents, and account data from the devices of infected users.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.