TF-2020291
high
📛 Threat Title
Vidar: Domain that is used for botnet Command&control (C&C) eb.amarikatoto.com
Description
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-11-08 07:05:34 UTC. Reporter: crep1x. Tags: Vidar.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
eb.amarikatoto.com
UrlVoid 1 / 36
IOC database
- Type
- domain
- Value
eb.amarikatoto.com- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain that is used for botnet Command&control (C&C) attributed to Vidar
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-11-08 07:05:34 UTC. Reporter: crep1x. Tags: Vidar.
Remediations (10)
-
web:feed.craftedsignal.io
ThreatFox identified 162 new indicators associated with the Vidar information stealer, primarily consisting of active command-and-control domains and IP addresses.
-
web:unit42.paloaltonetworks.com
A cybercrime campaign combined a loader-as-a-service framework and DLL sideloading via a Go-compiled fake MpClient.dll, a novel evasion layer combination.
-
web:www.acronis.com
Vidar is an infostealer that harvests credentials to enable initial access brokers and ransomware crews. Read our complete guide to Vidar defense.
-
web:www.cyfirma.com
Key Findings Vidar is an information-stealing malware that targets a wide range of data. It is being sold as a malware-as-a-service on the dark web and underground forums. It comes with customizable functionality. The malware hides the core malicious code in an obfuscated form and decodes after analyzing the environment for debugger/analysis tools.
-
web:www.darktrace.com
In the latter half of 2022, Darktrace observed a rise in Vidar Stealer infections across its client base. These infections consisted in a predictable series of network behaviors, including usage of certain social media platforms for the retrieval of Command and Control (C2) information and usage of certain URI patterns in C2 communications. In the blog post, we will provide details of the ...
-
web:www.hhs.gov
Vidar frequently uses social media as part of its command and control (C2) infrastructure. The IP address of the C2 infrastructure will be embedded in a user profile on platforms like Mastodon, Telegram, etc. The malware can access this profile, contact the indicated IP address, and download configuration files, instructions, and other malware.
-
web:www.huntress.com
Vidar malware is an information-stealing trojan that targets sensitive data, such as login credentials and cryptocurrency wallets. It works by deploying a payload to infected systems, collecting data, and transmitting it to command and control servers controlled by attackers.
-
web:www.intrinsec.com
Figure 3: Vidar main domain inside "information.txt". The specific "reg" subdomain is a login and registration panel for clients of the stealer.
-
web:www.picussecurity.com
Vidar is a Windows information stealer sold as malware-as-a-service. Vidar's new version rewrites the malware in pure C with a multithreaded engine that scales to victim hardware.
-
web:www.pointwild.com
Initial Infection Vector for Vidar (2026) The initial infection vector for Vidar infostealer in 2026 has significantly evolved from traditional exploit-based delivery to highly user-driven and social engineering-based execution chains.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.