TF-1811929 high

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-05-13 19:00:13 UTC. Reporter: crep1x. Tags: Vidar.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile Threatfox IOCs/Threats
• ThreatFox IOC page Threatfox IOCs/Threats

  Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-05-13 19:00:13 UTC. Reporter: crep1x. Tags: Vidar.

• Deep Analysis of Vidar Information Stealer - eln0ty
  web:eln0ty.github.io

  Deep Analysis of Vidar Information Stealer 17 minute read On this page Vidar overview Sample Preparation (strings & dlls) Decrypt strings Building imports C2 Server How to understand the configuration format Folder generation Browsers 2 Factor Authentication software (2FA) Messengers Crypto Wallets Information log Result Other payloads Kill Task Exfiltration Conclusion Yara Rules Vidar (forked ...

  2026-05-22 00:34 UTC
• 300- 220 CBRTHD Topic 2: Introduction to Hunting for Command & Control
  web:learningnetwork.cisco.com

  A command-and-control (also referred to as C&C or C2) server is an endpoint compromised and controlled by an attacker. Devices on your network can be commandeered by a cybercriminal to become a command centre or a botnet (a term coined by a combination of the words "robot" and "network") with the intention of obtaining full network control.

  2026-05-22 00:34 UTC
• Recognizing Botnet Command and Control Made Simple
  web:networkthreatdetection.com

  Learn how recognizing botnet command and control patterns reveals hidden threats and keeps your network safe from malicious attacks.

  2026-05-22 00:34 UTC
• The Evolving Tactics of Vidar Stealer: From Phishing Emails to Social Media
  web:thehackernews.com

  Vidar stealer now uses throwaway accounts on social media platforms to retrieve the address of its command-and-control servers and steal information.

  2026-05-22 00:34 UTC
• What is Vidar stealer? | Kaspersky
  web:usa.kaspersky.com

  The Vidar stealer is a technical malware used to infect devices and steal information. Here's how it works and how to take preventative measures.

  2026-05-22 00:34 UTC
• Tracking Vidar Infrastructure with Censys
  web:www.censys.com

  Vidar Operational Details Vidar uses common network communication methods, and once in place, it will connect to a Telegram server to fetch the URL of the Command and Control (C2) server. In the following two screenshots, you will see examples of this C2 distribution method via Telegram or, if that fails, a backup Steam account.

  2026-05-22 00:34 UTC
• What is Vidar Malware? - Check Point Software
  web:www.checkpoint.com

  Among these are the use of a large executable file — designed to defeat antivirus scanners — and files digitally signed with an expired and potentially breached Avast digital certificate. Vidar is an infostealer and frequently uses social media as part of its command and control (C2) infrastructure.

  2026-05-22 00:34 UTC
• Vidar Stealer: An In-depth Analysis of an Information ... - CYFIRMA
  web:www.cyfirma.com

  Vidar Stealer integrated social media platforms like Telegram and Steam into its infrastructure, not only for providing updates and support to subscribers but also for command-and-control (C2) functionality. This includes embedding the IP address/ URL on the profile page, which the malware retrieves during the initial stage of execution.

  2026-05-22 00:34 UTC
• 4 Botnet Detection Techniques, Challenges & Best Practices
  web:www.radware.com

  4. Use sinkholing to study botnets and contain threats: Instead of blocking all botnet traffic immediately, redirect suspicious traffic to a controlled sinkhole server. This allows you to observe the botnet's C&C communication patterns and gather intelligence on infrastructure, malware distribution, and attacker motives. 5.

  2026-05-22 00:34 UTC
• Botnet Controller List (BCL) | Botnet C&C datasets | Spamhaus
  web:www.spamhaus.org

  The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware-infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.

  2026-05-22 00:34 UTC

Only Available for Registered Users. Sign in to view.