TF-1932738 high

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-09-25 08:35:46 UTC. Last seen: 2026-09-25 12:14:40 UTC. Reporter: crep1x. Tags: Vidar.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-09-25 08:35:46 UTC. Last seen: 2026-09-25 12:09:36 UTC. Reporter: crep1x. Tags: Vidar.

• Vidar Infostealer Being Spread through Phishing Emails - ASEC
  web:asec.ahnlab.com

  Vidar uses the Dead Drop Resolver (DDR) technique when communicating with the C&C server. The threat actor posts the C&C server address on their Telegram and Steam profile pages; Vidar then accesses those profile pages to retrieve the actual C&C server address.

  2026-09-25 15:06 UTC
• Vidar Malware Rewrites Its Obfuscation With Every Build to Make ...
  web:cybersecuritynews.com

  Vidar stealer evolves its code to evade detection while stealing passwords, cookies, wallet data, and system details from victims.

  2026-09-25 15:06 UTC
• ThreatFox | https://hj.1jp88.org/
  web:threatfox.abuse.ch

  Vidar IOC: https ://hj.1jp88.org/ ( url ) You are viewing the ThreatFox database entry for url https ://hj.1jp88.org/.

  2026-09-25 15:06 UTC
• Vidar Stealer: Malware Evolution & Acronis Defenses
  web:www.acronis.com

  What is Vidar Stealer? How Vidar malware works and how to defend against it Vidar is an infostealer that harvests credentials to enable initial access brokers and ransomware crews. Read our complete guide to Vidar defense.

  2026-09-25 15:06 UTC
• Tracking Vidar Infrastructure with Censys
  web:www.censys.com

  Vidar Operational Details Vidar uses common network communication methods, and once in place, it will connect to a Telegram server to fetch the URL of the Command and Control (C2) server. In the following two screenshots, you will see examples of this C2 distribution method via Telegram or, if that fails, a backup Steam account.

  2026-09-25 15:06 UTC
• eSentire Threat Intelligence Malware Analysis: Vidar Stealer
  web:www.esentire.com

  Dive deeper into the technical details gathered during eSentire's Threat Response Unit (TRU) team's research and threat analysis of the Vidar Stealer malware.

  2026-09-25 15:06 UTC
• Vidar Malware: Analysis, Detection, Removal | Huntress
  web:www.huntress.com

  Vidar malware is an information-stealing trojan that targets sensitive data, such as login credentials and cryptocurrency wallets. It works by deploying a payload to infected systems, collecting data, and transmitting it to command and control servers controlled by attackers.

  2026-09-25 15:06 UTC
• Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer ...
  web:www.levelblue.com

  While it is widely used for benign automation, threat actors frequently abuse AutoIt to create compiled scripts that can execute malicious code, load encrypted payloads, and evade traditional security detection. Because AutoIt executables resemble normal applications, they are often used as stealthy loaders in multi-stage attacks.

  2026-09-25 15:06 UTC
• Inside Vidar (2026): From Infection to Memory Execution via JPEG and ...
  web:www.pointwild.com

  Initial Infection Vector for Vidar (2026) The initial infection vector for Vidar infostealer in 2026 has significantly evolved from traditional exploit-based delivery to highly user-driven and social engineering-based execution chains.

  2026-09-25 15:06 UTC
• PDF Vidar - Stealerware - Quorum Cyber
  web:www.quorumcyber.com

  Vidar is a strain of "information stealer", or "infostealer", malware, compiled in C++, which collects personal information, private documents, and account data from the devices of infected users.

  2026-09-25 15:06 UTC

Only Available for Registered Users. Sign in to view.