TF-2013332 high

Description

Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: Vidar. Confidence: 95. First seen: 2026-11-03 16:42:46 UTC. Reporter: Grim.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile Threatfox IOCs/Threats
• ThreatFox IOC page Threatfox IOCs/Threats

  Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: Vidar. Confidence: 95. First seen: 2026-11-03 16:42:46 UTC. Reporter: Grim.

• MalwareBazaar | Vidar - abuse.ch
  web:bazaar.abuse.ch

  A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as Vidar .

  2026-11-03 22:39 UTC
• MalwareBazaar | vidar - abuse.ch
  web:bazaar.abuse.ch

  Malware samples associated with tag vidar MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with vidar . Database Entry

  2026-11-03 22:39 UTC
• Vidar Uses JPEG and TXT Payloads for Fileless Execution
  web:socprime.com

  The report examines how Vidar has evolved into a multi-stage, fileless attack framework that combines Go-based loaders, VBS, PowerShell, and living-off-the-land binaries to retrieve malicious content concealed inside JPEG and TXT files hosted on a remote IP address.

  2026-11-03 22:39 UTC
• Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation
  web:unit42.paloaltonetworks.com

  Static disassembly of the Vidar core payload sample (SHA256 hash : 7ed4a256e1d281cb4f194d13ff554fb280dafde0a67a18115ea038ea6c87d) reveals an in-memory Antimalware Scan Interface (AMSI) bypass that executes before any stealer logic runs. The routine loads amsi.dll, resolves the AmsiScanBuffer variable and overwrites its first six bytes with a patch.

  2026-11-03 22:39 UTC
• Vidar - payload inspection with static analysis
  web:viuleeenz.github.io

  As already mentioned, Vidar payload contains few encrypted strings to slow down the analysis and probably to evade few monitoring solutions. Because of that, there is a function that is in charge to retrieve the plaintext associated with each encrypted string.

  2026-11-03 22:39 UTC
• Vidar Malware: Analysis, Detection, Removal | Huntress
  web:www.huntress.com

  Vidar malware is an information-stealing trojan that targets sensitive data, such as login credentials and cryptocurrency wallets. It works by deploying a payload to infected systems, collecting data, and transmitting it to command and control servers controlled by attackers.

  2026-11-03 22:39 UTC
• PDF : Vidar INTRINSEC Innovative b
  web:www.intrinsec.com

  • Analysis of the Vidar sample . While the new version of the malware was already recently analysed by other editors, we gave details on the C2 recovery mechanism using dead drop resolvers, control flow flattening to slow down analysis. The discovery of an unpacked sample potentially uploaded by a Russian threat actor on VirusTotal reveals the classic stealing capabilities.

  2026-11-03 22:39 UTC
• Inside Vidar (2026): From Infection to Memory Execution via JPEG and ...
  web:www.pointwild.com

  This analysis by Point Wild highlights a sophisticated, multi-stage malware campaign that leverages layered obfuscation, staged payload delivery, and trusted Windows components to achieve stealthy execution and persistence.

  2026-11-03 22:39 UTC
• PDF Malware Analysis Report Vidar - Stealerware - Quorum Cyber
  web:www.quorumcyber.com

  The malware itself is either a fork, or evolution of , the "Arkei" malware variant. Moreover, Vidar malware can be obtained as a " Malware - as -a-Service (MaaS)" offering, meaning that the threat group can lease out the same infrastructure to multiple, less established, threat actors for a variety of purposes.

  2026-11-03 22:39 UTC
• Peeling Back the Layers: Inside Vidar - From Virtualized Code ... - Splunk
  web:www.splunk.com

  The Vidar sample examined in this analysis raises the bar even further by introducing a custom virtual machine (VM) to protect its internal logic. Rather than exposing critical routines to traditional static analysis, the malware translates portions of its functionality like string encryption into virtualized instructions executed by its own ...

  2026-11-03 22:39 UTC

Only Available for Registered Users. Sign in to view.