TF-1931100
high
📛 Threat Title
Vidar: Domain that is used for botnet Command&control (C&C) sd.1jp88.org
Description
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-09-23 23:05:46 UTC. Reporter: crep1x. Tags: Vidar.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
sd.1jp88.org
UrlVoid 0 / 36
IOC database
- Type
- domain
- Value
sd.1jp88.org- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain that is used for botnet Command&control (C&C) attributed to Vidar
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-09-23 23:05:46 UTC. Reporter: crep1x. Tags: Vidar.
Remediations (10)
-
web:cipherssecurity.com
Vidar 2.0's rewrite in C, polymorphic build infrastructure, and Dead Drop Resolver C2 pattern make it meaningfully harder to detect than earlier versions. The YARA rules and behavioral signatures above target implementation patterns — WinINet call sequences, staging directory artifacts, Defender exclusion writes — that persist across ...
-
web:socprime.com
The campaign also relies on Telegram and Cloudflare-fronted domains for command-and-control and data exfiltration. Investigation Point Wild researchers traced the full infection chain from the initial Go-compiled dropper to the final Vidar payload, documenting each layer of obfuscation along the way.
-
web:www.censys.com
Vidar Operational Details Vidar uses common network communication methods, and once in place, it will connect to a Telegram server to fetch the URL of the Command and Control (C2) server. In the following two screenshots, you will see examples of this C2 distribution method via Telegram or, if that fails, a backup Steam account.
-
web:www.hhs.gov
Vidar frequently uses social media as part of its command and control (C2) infrastructure. The IP address of the C2 infrastructure will be embedded in a user profile on platforms like Mastodon, Telegram, etc. The malware can access this profile, contact the indicated IP address, and download configuration files, instructions, and other malware.
-
web:www.huntress.com
Vidar malware is an information-stealing trojan that targets sensitive data, such as login credentials and cryptocurrency wallets. It works by deploying a payload to infected systems, collecting data, and transmitting it to command and control servers controlled by attackers.
-
web:www.intrinsec.com
Figure 3: Vidar main domain inside "information.txt". The specific "reg" subdomain is a login and registration panel for clients of the stealer.
-
web:www.levelblue.com
While it is widely used for benign automation, threat actors frequently abuse AutoIt to create compiled scripts that can execute malicious code, load encrypted payloads, and evade traditional security detection. Because AutoIt executables resemble normal applications, they are often used as stealthy loaders in multi-stage attacks.
-
web:www.pointwild.com
Initial Infection Vector for Vidar (2026) The initial infection vector for Vidar infostealer in 2026 has significantly evolved from traditional exploit-based delivery to highly user-driven and social engineering-based execution chains.
-
web:www.quorumcyber.com
Vidar is a strain of "information stealer", or "infostealer", malware, compiled in C++, which collects personal information, private documents, and account data from the devices of infected users.
-
web:www.spamhaus.org
The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware-infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.