TF-2013329
high
📛 Threat Title
Vidar: MD5 hash of a malware sample (payload) dd40a776e6ca00d9ca8bd3cb06e2b8b7
Description
Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: Vidar. Confidence: 95. First seen: 2026-11-03 16:42:45 UTC. Reporter: Grim.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_md5
dd40a776e6ca00d9ca8bd3cb06e2b8b7
IOC database
- Type
- hash_md5
- Value
dd40a776e6ca00d9ca8bd3cb06e2b8b7- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- MD5 hash of a malware sample (payload) attributed to Vidar
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile Threatfox IOCs/Threats
-
ThreatFox IOC page
Threatfox IOCs/Threats
Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: Vidar. Confidence: 95. First seen: 2026-11-03 16:42:45 UTC. Reporter: Grim.
Remediations (10)
-
web:bazaar.abuse.ch
A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as Vidar .
-
web:bazaar.abuse.ch
Malware samples associated with tag vidar MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with vidar . Database Entry
-
web:cipherssecurity.com
Check MD5 , SHA-1, or SHA-256 file hashes against MalwareBazaar and VirusTotal feeds. Drop a file — hashing happens in your browser, never uploaded.
-
web:imalware.com
It compares a file's fingerprint (its MD5 , SHA-1 or SHA-256 hash ) with a list of fingerprints of known malware . If the hash matches, the file is identical to a known malicious sample .
-
web:inventivehq.com
Check any file hash in seconds. Paste an MD5 , SHA-1 or SHA-256 hash , or drop a file to hash it locally, then check it against live malware feeds.
-
web:socprime.com
The report examines how Vidar has evolved into a multi-stage, fileless attack framework that combines Go-based loaders, VBS, PowerShell, and living-off-the-land binaries to retrieve malicious content concealed inside JPEG and TXT files hosted on a remote IP address.
-
web:www.huntress.com
Vidar malware is an information-stealing trojan that targets sensitive data, such as login credentials and cryptocurrency wallets. It works by deploying a payload to infected systems, collecting data, and transmitting it to command and control servers controlled by attackers.
-
web:www.intrinsec.com
• Analysis of the Vidar sample . While the new version of the malware was already recently analysed by other editors, we gave details on the C2 recovery mechanism using dead drop resolvers, control flow flattening to slow down analysis. The discovery of an unpacked sample potentially uploaded by a Russian threat actor on VirusTotal reveals the classic stealing capabilities.
-
web:www.pointwild.com
This analysis by Point Wild highlights a sophisticated, multi-stage malware campaign that leverages layered obfuscation, staged payload delivery, and trusted Windows components to achieve stealthy execution and persistence.
-
web:www.quorumcyber.com
Executive Summary • Vidar is a strain of "information stealer", or "infostealer", malware , compiled in C++, which collects personal information, private documents, and account data from the devices of infected users. The malware itself is either a fork, or evolution of , the "Arkei" malware variant. Moreover, Vidar malware can be obtained as a " Malware - as -a-Service (MaaS ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.