Vidar

Malware Family

10 871 indicators of compromise attributed to Vidar across abuse.ch threat intelligence feeds.

Domains

1 366

IPs

606

URLs

1 990

Hashes

6 909

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (1 366)IPs (606)URLs (1 990)Hashes (6 909)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
qhl.biolinks.com.brdomain
ooo.websitearaxa.comdomain
fsn.syslicense.netdomain
gjt.clashofmaps.vipdomain
sss.orilowa.comdomain
bom.jangkarsm188.topdomain
pay.cardiffphysio.comdomain
rrr.sm188dvlv.latdomain
sup.merahsm188.topdomain
hkd.138sportlogin.orgdomain
kee.sm188dadu.topdomain
ctl.it-bd.comdomain
ehj.chriskendall.mediadomain
orhz.optiframe.prodomain
gre.ssffaa4.xyzdomain
bhayatravels.comdomain
prd.rzrrent.comdomain
sh.199cuan.orgdomain
zaf.11gokil.orgdomain
cafe-92.comdomain
104.105.9.5ip
62.238.22.252ip
138.199.246.59ip
91.107.150.39ip
168.119.68.217ip
135.181.35.32ip
37.27.227.56ip
158.94.210.96ip
74.0.48.207ip
65.109.255.31ip
77.42.49.112ip
167.233.168.67ip
157.180.91.189ip
74.0.32.113ip
95.216.103.173ip
159.69.23.17ip
2.29.22.60ip
65.108.71.75ip
74.0.48.55ip
91.99.3.102ip
https://svb.smtpdenz.my.id/url
https://49.12.9.171/url
https://pz.32naga.net/url
https://pay.cardiffphysio.com/url
https://65.109.165.156/url
https://svb.orilowa.com/url
https://rpa.vi-ler.dk/url
https://set.10001slot.org/url
https://45.86.64.51url
https://136.243.116.63url
https://157.180.81.4url
https://poh.10001slot.orgurl
https://wsp.biolinks.com.br/url
https://95.216.103.169/url
https://sra.paptogel.net/url
https://kot.denzcodex.my.id/url
https://hab.paptogel.net/url
https://172.236.209.126/url
https://juj.realmadridiran.news/url
https://fog.codetohaven.com/url

Another file to check? Run a file hash reputation check.