TF-1932740
high
📛 Threat Title
Vidar: URL that is used for botnet Command&control (C&C) https://hj.234-e.com/
Description
Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-09-25 08:35:46 UTC. Last seen: 2026-09-25 11:54:25 UTC. Reporter: crep1x. Tags: Vidar.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
url
https://hj.234-e.com/
VT 1 / 91
UrlVoid 4 / 36
IOC database
- Type
- url
- Value
https://hj.234-e.com/- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- URL that is used for botnet Command&control (C&C) attributed to Vidar
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 1 of 91 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| Dr.Web | malicious | malicious |
Details From VirusTotal
Basic Properties
| TLD | com |
| Final URL | https://hj.234-e.com/ |
| Last HTTP status | 429 |
History
| First seen on VirusTotal | 2026-09-25 08:36 UTC |
| Last submission | 2026-09-25 08:36 UTC |
| Last analysis | 2026-09-25 08:36 UTC |
| Last modified on VirusTotal | 2026-09-26 00:04 UTC |
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-09-25 08:35:46 UTC. Last seen: 2026-09-25 11:54:25 UTC. Reporter: crep1x. Tags: Vidar.
Remediations (10)
-
web:any.run
Vidar is an information stealer trojan. It is either a fork of Vidar or the result of its evolution. Follow live malware statistics of this trojan and get new reports, samples, IOCs, etc.
-
web:www.bsi.bund.de
Additionally, Vidar is often used to download additional malware, such as ransomware. How did I get infected with Vidar ? Vidar typically infects computers via malicious downloads and email attachments. Cybercriminals often send fake invoices, software updates or installers (e.g. ISO/ZIP files or Office documents with macros) that contain Vidar .
-
web:www.censys.com
Vidar Operational Details Vidar uses common network communication methods, and once in place, it will connect to a Telegram server to fetch the URL of the Command and Control (C2) server. In the following two screenshots, you will see examples of this C2 distribution method via Telegram or, if that fails, a backup Steam account.
-
web:www.checkpoint.com
Vidar is an infostealer malware that can also be used to deliver additional forms of malware. Some of the ways that an organization can protect against this malware threat include the following: Employee Training: Vidar is commonly distributed via phishing emails or fake downloads of legitimate software, which actually deliver the malware.
-
web:www.cyfirma.com
Key Findings Vidar is an information-stealing malware that targets a wide range of data. It is being sold as a malware-as-a-service on the dark web and underground forums. It comes with customizable functionality. The malware hides the core malicious code in an obfuscated form and decodes after analyzing the environment for debugger/analysis tools.
-
web:www.hhs.gov
Vidar frequently uses social media as part of its command and control (C2) infrastructure. The IP address of the C2 infrastructure will be embedded in a user profile on platforms like Mastodon, Telegram, etc. The malware can access this profile, contact the indicated IP address, and download configuration files, instructions, and other malware.
-
web:www.huntress.com
Vidar malware is an information-stealing trojan that targets sensitive data, such as login credentials and cryptocurrency wallets. It works by deploying a payload to infected systems, collecting data, and transmitting it to command and control servers controlled by attackers.
-
web:www.intrinsec.com
Detailed in this report: • The state of Vidar in the beginning of 2026. Following major takedowns affecting Lumma and Rhadamanthys, Vidar profited from the generated chaos to rise to the top of the stealer ecosystem. We assess that this rise was made available due to the release of version 2.0 of the malware, and to the collaboration with "Cloud" Telegram channels.
-
web:www.pointwild.com
Initial Infection Vector for Vidar (2026) The initial infection vector for Vidar infostealer in 2026 has significantly evolved from traditional exploit-based delivery to highly user-driven and social engineering-based execution chains.
-
web:www.quorumcyber.com
Vidar is a strain of "information stealer", or "infostealer", malware, compiled in C++, which collects personal information, private documents, and account data from the devices of infected users.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.