TF-1812286 high

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-05-14 20:00:12 UTC. Reporter: crep1x. Tags: Vidar.

Indicators of Compromise (5)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile Threatfox IOCs/Threats
• ThreatFox IOC page Threatfox IOCs/Threats

  Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-05-14 20:00:12 UTC. Reporter: crep1x. Tags: Vidar.

• Vidar Trojan Analysis, Malware Overview by ANY.RUN
  web:any.run

  Vidar is an information stealer trojan. It is either a fork of Vidar or the result of its evolution. Follow live malware statistics of this trojan and get new reports, samples, IOCs, etc.

  2026-05-22 00:46 UTC
• Vidar: Windows Info-Stealing Malware Analysis
  web:hunt.io

  Explore Vidar , a Windows-based info-stealing malware. Learn about its data theft capabilities, distribution methods, and mitigation strategies.

  2026-05-22 00:46 UTC
• The Evolving Tactics of Vidar Stealer: From Phishing Emails to Social Media
  web:thehackernews.com

  Vidar stealer now uses throwaway accounts on social media platforms to retrieve the address of its command-and-control servers and steal information.

  2026-05-22 00:46 UTC
• Tracking Vidar Infrastructure with Censys
  web:www.censys.com

  Vidar Operational Details Vidar uses common network communication methods, and once in place, it will connect to a Telegram server to fetch the URL of the Command and Control (C2) server. In the following two screenshots, you will see examples of this C2 distribution method via Telegram or, if that fails, a backup Steam account.

  2026-05-22 00:46 UTC
• What is Vidar Malware? - Check Point Software
  web:www.checkpoint.com

  Vidar is an infostealer malware that can also be used to deliver additional forms of malware. Some of the ways that an organization can protect against this malware threat include the following: Employee Training: Vidar is commonly distributed via phishing emails or fake downloads of legitimate software, which actually deliver the malware.

  2026-05-22 00:46 UTC
• Vidar Stealer: An In-depth Analysis of an Information ... - CYFIRMA
  web:www.cyfirma.com

  Additionally, it examines their utilization of social media platforms to procure command and control details for data exfiltration and updates. Introduction This study provides a concise overview of Vidar Stealer, a potent malware written in C++, capable of stealing a wide range of data from the compromised system.

  2026-05-22 00:46 UTC
• Vidar Network: Analyzing a Prolific Info Stealer - Darktrace
  web:www.darktrace.com

  In the latter half of 2022, Darktrace observed a rise in Vidar Stealer infections across its client base. These infections consisted in a predictable series of network behaviors, including usage of certain social media platforms for the retrieval of Command and Control (C2) information and usage of certain URI patterns in C2 communications. In the blog post, we will provide details of the ...

  2026-05-22 00:46 UTC
• Inside Vidar (2026): From Infection to Memory Execution via JPEG and ...
  web:www.pointwild.com

  Initial Infection Vector for Vidar (2026) The initial infection vector for Vidar infostealer in 2026 has significantly evolved from traditional exploit-based delivery to highly user-driven and social engineering-based execution chains.

  2026-05-22 00:46 UTC
• PDF Vidar - Stealerware - Quorum Cyber
  web:www.quorumcyber.com

  Vidar is a strain of "information stealer", or "infostealer", malware, compiled in C++, which collects personal information, private documents, and account data from the devices of infected users.

  2026-05-22 00:46 UTC
• Botnet Controller List (BCL) | Botnet C&C datasets | Spamhaus
  web:www.spamhaus.org

  The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware-infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.

  2026-05-22 00:46 UTC

Only Available for Registered Users. Sign in to view.