TF-1815122 high

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-05-17 05:50:12 UTC. Reporter: burger. Tags: c2, Vidar.

Indicators of Compromise (2)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (3)

• External reference Threatfox IOCs/Threats
• Malpedia profile Threatfox IOCs/Threats
• ThreatFox IOC page Threatfox IOCs/Threats

  Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-05-15 19:31:31 UTC. Reporter: burger. Tags: c2, Vidar.

• Vidar Trojan Analysis, Malware Overview by ANY.RUN
  web:any.run

  Vidar is an information stealer trojan. It is either a fork of Vidar or the result of its evolution. Follow live malware statistics of this trojan and get new reports, samples, IOCs, etc.

  2026-05-22 02:01 UTC
• Cyble - Vidar Stealer Under The Lens: A Deep-dive Analysis
  web:cyble.com

  The Vidar malware family, which was first identified in 2018, is capable of stealing sensitive data from the victim's PC. This includes banking information, saved passwords, IP addresses, browser history, login credentials, and crypto-wallets, which can then be transferred to the TAs Command and Control ( C&C ).

  2026-05-22 02:01 UTC
• Feodo Tracker | Blocklist - abuse.ch
  web:feodotracker.abuse.ch

  Dridex, Heodo (aka Emotet), TrickBot, QakBot (aka QuakBot / Qbot) and BazarLoader (aka BazarBackdoor) botnet command&control servers (C2s) usually reside on compromised servers and such that have been rented and setup by the threat actor itself for the sole purpose of botnet hosting. Feodo Tracker offers a blocklist of IP addresses that are associated with such botnet C2s. It can be used to ...

  2026-05-22 02:01 UTC
• The Evolving Tactics of Vidar Stealer: From Phishing Emails to Social Media
  web:thehackernews.com

  Vidar stealer now uses throwaway accounts on social media platforms to retrieve the address of its command-and-control servers and steal information.

  2026-05-22 02:01 UTC
• What is Vidar stealer? | Kaspersky
  web:usa.kaspersky.com

  The Vidar stealer is a technical malware used to infect devices and steal information. Here's how it works and how to take preventative measures.

  2026-05-22 02:01 UTC
• Tracking Vidar Infrastructure with Censys
  web:www.censys.com

  Vidar Operational Details Vidar uses common network communication methods, and once in place, it will connect to a Telegram server to fetch the URL of the Command and Control (C2) server. In the following two screenshots, you will see examples of this C2 distribution method via Telegram or, if that fails, a backup Steam account.

  2026-05-22 02:01 UTC
• What is Vidar Malware? - Check Point Software
  web:www.checkpoint.com

  Vidar is an infostealer malware that can also be used to deliver additional forms of malware. Some of the ways that an organization can protect against this malware threat include the following: Employee Training: Vidar is commonly distributed via phishing emails or fake downloads of legitimate software, which actually deliver the malware.

  2026-05-22 02:01 UTC
• Vidar Stealer: An In-depth Analysis of an Information ... - CYFIRMA
  web:www.cyfirma.com

  Key Findings Vidar is an information-stealing malware that targets a wide range of data. It is being sold as a malware-as-a-service on the dark web and underground forums. It comes with customizable functionality. The malware hides the core malicious code in an obfuscated form and decodes after analyzing the environment for debugger/analysis tools.

  2026-05-22 02:01 UTC
• PDF 202407021700_Vidar Malware Analyst Note_TLPCLEAR - HHS.gov
  web:www.hhs.gov

  Vidar frequently uses social media as part of its command and control (C2) infrastructure. The IP address of the C2 infrastructure will be embedded in a user profile on platforms like Mastodon, Telegram, etc. The malware can access this profile, contact the indicated IP address, and download configuration files, instructions, and other malware.

  2026-05-22 02:01 UTC
• Botnet Controller List (BCL) | Botnet C&C datasets | Spamhaus
  web:www.spamhaus.org

  The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware-infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.

  2026-05-22 02:01 UTC

Only Available for Registered Users. Sign in to view.