Vidar Stealer: New command-and-control infrastructure
ThreatFox identified 162 new indicators associated with the Vidar information stealer, primarily consisting of active command-and-control domains and IP addresses.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 5, 13:42 UTC
- Detection
- 6 IOCs
- Source quality
- A1Very likely
On November 4, 2026, ThreatFox reported 162 new indicators of compromise (IOCs) associated with the Vidar information stealer. The updated intelligence includes 156 indicators categorized as botnet command-and-control (C2) infrastructure and 6 malicious payload samples. The infrastructure consists of 98 URLs, 51 domains, and 7 IP:port combinations.
Impact
Vidar is an information-stealing malware designed to exfiltrate sensitive data, including browser credentials, cryptocurrency wallets, and system configuration information, to attacker-controlled infrastructure.
Recommendation
- Block the listed C2 domains and IP addresses at the organizational DNS resolver and firewall.
- Implement file integrity monitoring or EDR blocks for the identified SHA-256 file hashes to prevent payload execution.
- Prioritize threat hunting for network connections to the provided IP addresses and domain infrastructure.
Immediate actions
Block listed domains and IP addresses at perimeter firewall and DNS sinkhole.
Threat Hunt
Identify endpoints communicating with the identified C2 IPs and domains
Data: Proxy logs, DNS query logs, Netflow
Indicators of compromise
3
domain
2
hash_sha256
1
ip
| Type | Value |
|---|---|
| domain | cuit8.org |
| domain | alloha4d.org |
| domain | allbaslot.org |
| hash_sha256 | 423f9649baabc8864818e9fd3234df4841eced82f8663bac490ed3cde93c306c |
| hash_sha256 | 0f08e05e915c9628fb031623dbc63e1b40fcb7066659e7c969c3d08b9c43f734 |
| ip | 2.29.152.8 |