s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-1868458 high

📛 Threat Title

Vidar: Domain that is used for botnet Command&control (C&C) bib.y8slot.net

Category: Vidar Published: Source updated: First seen: Last updated: Source: ThreatFox IOCs

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-08-04 18:15:07 UTC. Last seen: 2026-08-04 21:26:06 UTC. Reporter: crep1x. Tags: Vidar.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain bib.y8slot.net

IOC database

Type
domain
Value
bib.y8slot.net
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Domain that is used for botnet Command&control (C&C) attributed to Vidar

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

References (2)

  • Malpedia profile ThreatFox IOCs
  • ThreatFox IOC page ThreatFox IOCs

    Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-08-04 18:15:07 UTC. Reporter: crep1x. Tags: Vidar.

Remediations (10)

  • Vidar Trojan Analysis, Malware Overview by ANY.RUN
    web:any.run

    Vidar is an information stealer trojan. It is either a fork of Vidar or the result of its evolution. Follow live malware statistics of this trojan and get new reports, samples, IOCs, etc.

  • Vidar Infostealer Being Spread through Phishing Emails - ASEC
    web:asec.ahnlab.com

    Vidar uses the Dead Drop Resolver (DDR) technique when communicating with the C&C server. The threat actor posts the C&C server address on their Telegram and Steam profile pages; Vidar then accesses those profile pages to retrieve the actual C&C server address.

  • What is Vidar stealer? | Kaspersky
    web:usa.kaspersky.com

    The Vidar stealer is a technical malware used to infect devices and steal information. Here's how it works and how to take preventative measures.

  • Vidar Network: Analyzing a Prolific Info Stealer - Darktrace
    web:www.darktrace.com

    In the latter half of 2022, Darktrace observed a rise in Vidar Stealer infections across its client base. These infections consisted in a predictable series of network behaviors, including usage of certain social media platforms for the retrieval of Command and Control (C2) information and usage of certain URI patterns in C2 communications.

  • eSentire Threat Intelligence Malware Analysis: Vidar Stealer
    web:www.esentire.com

    Dive deeper into the technical details gathered during eSentire's Threat Response Unit (TRU) team's research and threat analysis of the Vidar Stealer malware.

  • "Chaos is a ladder": Vidar's recent rise to the top - INTRINSEC
    web:www.intrinsec.com

    The state of Vidar in the beginning of 2026. Following major takedowns affecting Lumma and Rhadamanthys, Vidar took advantage of the generated chaos to rise to the top of the stealer ecosystem. We assess that this rise was made available due to the release of version 2.0 of the malware, and to the collaboration with "Cloud" Telegram channels.

  • PDF : Vidar - intrinsec.com
    web:www.intrinsec.com

    t base. Inside logs collected by Vidar , the file "information.txt" reveals the domain used to advertise Vidar , which is now vid Figure 3: Vidar main domain inside "information.txt". The specific "reg" subdomain is a login and registration panel for clients of the stealer. Figure 4: Content of the registration panel.

  • Hacked sites deliver Vidar infostealer to Windows users
    web:www.malwarebytes.com

    We found fake "verify you are human" pages on hacked WordPress sites that trick Windows users into installing the Vidar infostealer.

  • Inside Vidar (2026): From Infection to Memory Execution via JPEG and ...
    web:www.pointwild.com

    Initial Infection Vector for Vidar (2026) The initial infection vector for Vidar infostealer in 2026 has significantly evolved from traditional exploit-based delivery to highly user-driven and social engineering-based execution chains.

  • Botnet Controller List (BCL) | Botnet C&C datasets | Spamhaus
    web:www.spamhaus.org

    About the Data The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware-infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.