malware · Mon 27 Jul 2026 · 17:36 UTC

Vidar Malware: How the Multithreaded Windows Stealer Works

submitted by <a href="https://www.reddit.com/user/jnazario"> /u/jnazario </a> <a href="https://www.picussecurity.com/resource/blog/vidar-malware-how-the-multithreaded-windows-stealer-works">[link]</a> <a href="https://www.reddit.com/r/blueteamsec/comments/1v879ug/vidar_malware_how_the_multithreaded_windows/">[comments]</a>…

Indicators · 20

defanged · cross-checked abuse.ch ThreatFox

Vidar · active infrastructure20

live · abuse.ch

The threat this dispatch names — its currently active indicators on abuse.ch. Tied to the threat, not to the dispatch.

URL
hxxps://2[.]29[.]7[.]186/
Botnet C2100%2026-08-20
IP
2[.]29[.]7[.]186:443
Botnet C2100%2026-08-20
URL
hxxps://62[.]238[.]44[.]228/
Botnet C2100%2026-08-24
URL
hxxps://2[.]29[.]15[.]189/
Botnet C2100%2026-08-24
URL
hxxps://2[.]29[.]9[.]195/
Botnet C2100%2026-08-24
URL
hxxps://62[.]238[.]46[.]243/
Botnet C2100%2026-08-24
IP
62[.]238[.]44[.]228:443
Botnet C2100%2026-08-24
IP
2[.]29[.]15[.]189:443
Botnet C2100%2026-08-24
IP
2[.]29[.]9[.]195:443
Botnet C2100%2026-08-24
IP
62[.]238[.]46[.]243:443
Botnet C2100%2026-08-24
URL
hxxps://62[.]238[.]36[.]8/
Botnet C2100%2026-08-25
IP
62[.]238[.]36[.]8:443
Botnet C2100%2026-08-25
URL
hxxps://5[.]9[.]73[.]173/
Botnet C2100%2026-09-16
IP
5[.]9[.]73[.]173:443
Botnet C2100%2026-09-16
URL
hxxps://2[.]29[.]7[.]186
Botnet C2100%2026-09-26

Indicators

checking abuse.ch ThreatFox

Checking indicators against ThreatFox…

Get the next one first.

Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.