TF-1932739
high
📛 Threat Title
Vidar: Domain that is used for botnet Command&control (C&C) hj.234-e.com
Description
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-09-25 08:35:46 UTC. Last seen: 2026-09-25 08:50:45 UTC. Reporter: crep1x. Tags: Vidar.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
hj.234-e.com
VT 2 / 91
IOC database
- Type
- domain
- Value
hj.234-e.com- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- Ingested from IOC source: https://threatfox.abuse.ch/downloads/hostfile/
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 2 of 91 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| Dr.Web | malicious | malicious |
| SOCRadar | malicious | malicious |
Details From VirusTotal
Basic Properties
| Registrar | NAMECHEAP INC |
| TLD | com |
History
| Creation date | 2026-06-23 09:01 UTC |
| Last analysis | 2026-09-25 11:09 UTC |
| Last modified on VirusTotal | 2026-09-25 13:36 UTC |
| Last WHOIS update | 2026-06-23 09:02 UTC |
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-09-25 08:35:46 UTC. Last seen: 2026-09-25 08:50:45 UTC. Reporter: crep1x. Tags: Vidar.
Remediations (10)
-
web:cyble.com
The Vidar malware family, which was first identified in 2018, is capable of stealing sensitive data from the victim's PC. This includes banking information, saved passwords, IP addresses, browser history, login credentials, and crypto-wallets, which can then be transferred to the TAs Command and Control ( C&C ).
-
web:www.acronis.com
Vidar is an infostealer that harvests credentials to enable initial access brokers and ransomware crews. Read our complete guide to Vidar defense.
-
web:www.bsi.bund.de
Additionally, Vidar is often used to download additional malware, such as ransomware. How did I get infected with Vidar ? Vidar typically infects computers via malicious downloads and email attachments. Cybercriminals often send fake invoices, software updates or installers (e.g. ISO/ZIP files or Office documents with macros) that contain Vidar .
-
web:www.censys.com
Vidar Operational Details Vidar uses common network communication methods, and once in place, it will connect to a Telegram server to fetch the URL of the Command and Control (C2) server. In the following two screenshots, you will see examples of this C2 distribution method via Telegram or, if that fails, a backup Steam account.
-
web:www.checkpoint.com
What is Vidar Malware? Vidar is an infostealer malware operating as malware-as-a-service that was first discovered in the wild in late 2018. The malware runs on Windows and can collect a wide range of sensitive data from browsers and digital wallets. Additionally, the malware is used as a downloader for ransomware. Since its emergence in 2018, Vidar has grown to one of the most successful ...
-
web:www.cyfirma.com
Additionally, it examines their utilization of social media platforms to procure command and control details for data exfiltration and updates. Introduction This study provides a concise overview of Vidar Stealer, a potent malware written in C++, capable of stealing a wide range of data from the compromised system.
-
web:www.huntress.com
Vidar malware is an information-stealing trojan designed to exfiltrate sensitive data like passwords, credit card info, and cryptocurrency wallet details. It is often used by cybercriminals as a precursor to larger attacks, such as ransomware deployment.
-
web:www.intrinsec.com
Detailed in this report: • The state of Vidar in the beginning of 2026. Following major takedowns affecting Lumma and Rhadamanthys, Vidar profited from the generated chaos to rise to the top of the stealer ecosystem. We assess that this rise was made available due to the release of version 2.0 of the malware, and to the collaboration with "Cloud" Telegram channels.
-
web:www.pointwild.com
Initial Infection Vector for Vidar (2026) The initial infection vector for Vidar infostealer in 2026 has significantly evolved from traditional exploit-based delivery to highly user-driven and social engineering-based execution chains.
-
web:www.spamhaus.org
The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware-infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.