TF-1812109
high
📛 Threat Title
Vidar: URL that is used for botnet Command&control (C&C) https://fke.dusapp.com.br/
Description
Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-05-14 07:30:13 UTC. Reporter: crep1x. Tags: Vidar.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
ipv4
188.114.96.3
VT 0 / 92
IOC database
- Type
- ipv4
- Value
188.114.96.3- First seen
- Last seen
- Attached to this threat
- Appears in
- 105 threats
- Description
- Resolved from domain xingshang734.xyz
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
Basic Properties
| Network | 188.114.96.0/22 |
| AS owner | Cloudflare, Inc. |
| ASN | 13335 |
History
| Last analysis | 2026-05-16 04:56 UTC |
| Last modified on VirusTotal | 2026-05-16 04:57 UTC |
| WHOIS record date | 2026-05-07 15:07 UTC |
ipv4
188.114.97.3
VT 8 / 92
IOC database
- Type
- ipv4
- Value
188.114.97.3- First seen
- Last seen
- Attached to this threat
- Appears in
- 105 threats
- Description
- Resolved from domain xingshang734.xyz
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 8 of 92 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| ADMINUSLabs | malicious | malicious |
| Chong Lua Dao | malicious | malicious |
| CyRadar | malicious | malicious |
| Lionic | malicious | malicious |
| Viettel Threat Intelligence | malicious | malicious |
| VIPRE | malicious | malware |
| Webroot | malicious | malicious |
| alphaMountain.ai | suspicious | suspicious |
Details From VirusTotal
Basic Properties
| Network | 188.114.96.0/22 |
| AS owner | Cloudflare, Inc. |
| ASN | 13335 |
History
| Last analysis | 2026-05-16 04:44 UTC |
| Last modified on VirusTotal | 2026-05-16 04:46 UTC |
| WHOIS record date | 2026-05-07 01:55 UTC |
url
https://fke.dusapp.com.br/
UrlVoid 5 / 35
IOC database
- Type
- url
- Value
https://fke.dusapp.com.br/- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- URL that is used for botnet Command&control (C&C) attributed to Vidar
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile Threatfox IOCs/Threats
-
ThreatFox IOC page
Threatfox IOCs/Threats
Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-05-14 07:30:13 UTC. Reporter: crep1x. Tags: Vidar.
Remediations (10)
-
web:101.school
Command and Control (C&C) servers play a crucial role in the operation of botnets and other forms of malware. They serve as the central hub from which cybercriminals can control infected machines, known as 'bots'.
-
web:any.run
Vidar is an information stealer trojan. It is either a fork of Vidar or the result of its evolution. Follow live malware statistics of this trojan and get new reports, samples, IOCs, etc.
-
web:eln0ty.github.io
Deep Analysis of Vidar Information Stealer 17 minute read On this page Vidar overview Sample Preparation (strings & dlls) Decrypt strings Building imports C2 Server How to understand the configuration format Folder generation Browsers 2 Factor Authentication software (2FA) Messengers Crypto Wallets Information log Result Other payloads Kill Task Exfiltration Conclusion Yara Rules Vidar (forked ...
-
web:github.com
Extracts Vidar config from Command & Control servers for specific botnets This script is capable of extracting information regarding specific botnets from Vidar Command & Control servers enabling researchers to track campaigns over time.
-
web:networkthreatdetection.com
Learn how recognizing botnet command and control patterns reveals hidden threats and keeps your network safe from malicious attacks.
-
web:pwn.guide
These servers enable an attacker to control and manage a network of compromised systems, forming a botnet . C&C servers provide a centralized command interface, allowing attackers to issue commands, upload and download files, update malware, and exfiltrate data from the compromised systems.
-
web:thehackernews.com
Vidar stealer now uses throwaway accounts on social media platforms to retrieve the address of its command-and-control servers and steal information.
-
web:www.acronis.com
Command-and-control (C2) infrastructure is hidden via Telegram bots and Steam profiles as dead drop resolvers. Taken together, these capabilities make Vidar 2.0 a powerful and stealthy threat, often completing its mission before victims are aware anything is wrong, and well before stolen data can be recovered or invalidated.
-
web:www.censys.com
Vidar Operational Details Vidar uses common network communication methods, and once in place, it will connect to a Telegram server to fetch the URL of the Command and Control (C2) server. In the following two screenshots, you will see examples of this C2 distribution method via Telegram or, if that fails, a backup Steam account.
-
web:www.researchgate.net
In our work, we approach the botnet detection problem through the detection of the command and control (C2) communication channels traffic that control the coordinated group of malware instances.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.