TF-1868465
high
📛 Threat Title
Vidar: Domain that is used for botnet Command&control (C&C) bib.sinism188.top
Description
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-08-04 18:20:05 UTC. Last seen: 2026-08-04 21:25:44 UTC. Reporter: crep1x. Tags: Vidar.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
bib.sinism188.top
UrlVoid 2 / 35
IOC database
- Type
- domain
- Value
bib.sinism188.top- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain that is used for botnet Command&control (C&C) attributed to Vidar
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-08-04 18:20:05 UTC. Reporter: crep1x. Tags: Vidar.
Remediations (8)
-
web:usa.kaspersky.com
The Vidar stealer is a technical malware used to infect devices and steal information. Here's how it works and how to take preventative measures.
-
web:www.bsi.bund.de
Malware: Vidar Malware Type: Stealer Affected Operating Systems: Windows Affected Device Types: PCs, laptops etc. Impact: high What is Vidar ? Vidar is a Windows infostealer that was first observed in late 2018. It can harvest a wide range of sensitive data from browsers, cryptocurrency wallets and other accounts. Additionally, Vidar is often used to download additional malware, such as ...
-
web:www.checkpoint.com
Vidar is an infostealer malware that can also be used to deliver additional forms of malware. Some of the ways that an organization can protect against this malware threat include the following: Employee Training: Vidar is commonly distributed via phishing emails or fake downloads of legitimate software, which actually deliver the malware.
-
web:www.huntress.com
Vidar malware is an information-stealing trojan that targets sensitive data, such as login credentials and cryptocurrency wallets. It works by deploying a payload to infected systems, collecting data, and transmitting it to command and control servers controlled by attackers.
-
web:www.intrinsec.com
The state of Vidar in the beginning of 2026. Following major takedowns affecting Lumma and Rhadamanthys, Vidar took advantage of the generated chaos to rise to the top of the stealer ecosystem. We assess that this rise was made available due to the release of version 2.0 of the malware, and to the collaboration with "Cloud" Telegram channels.
-
web:www.intrinsec.com
t base. Inside logs collected by Vidar , the file "information.txt" reveals the domain used to advertise Vidar , which is now vid Figure 3: Vidar main domain inside "information.txt". The specific "reg" subdomain is a login and registration panel for clients of the stealer. Figure 4: Content of the registration panel.
-
web:www.malwarebytes.com
We found fake "verify you are human" pages on hacked WordPress sites that trick Windows users into installing the Vidar infostealer.
-
web:www.pointwild.com
Initial Infection Vector for Vidar (2026) The initial infection vector for Vidar infostealer in 2026 has significantly evolved from traditional exploit-based delivery to highly user-driven and social engineering-based execution chains.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.