IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE15 IOCs

Vidar V1.5 in Go: Same Family, New Language, Heavy Sandbox Checks

OT
ORKL Threat Library
Original Report

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYunknownINFRASTRUCTUREhttps://steamcommunit…149.154.167.99telegram.me/pr55iiCAPABILITYLummaRhadamanthysVidarVICTIMunknown
Adversary
Infrastructure(6)
Capability(3)
Victim

Indicators of Compromise

15 indicators

TypeIndicatorConfidenceScoreFirst Seen
SHA1488d2dd8768e3b804179e7f0cdcebd0a7eec52b3HighScore 67/100First seen
URLhttps://steamcommunity.com/profiles/76561198707628078HighScore 86/100First seen
IP149.154.167.99HighScore 69/100First seen
URLtelegram.me/pr55iiHighScore 67/100First seen
URLhttps://telegram.me/hgo9txHighScore 86/100First seen
IP135.181.237.59HighScore 68/100First seen
URLtelegram.me/dikkh0kHighScore 67/100First seen
MD5702ef1b4007f07887e9faaee0667b50bHighScore 67/100First seen
URLtelegram.me/sre22qeHighScore 67/100First seen
URLhttps://www.derp.ca/research/vidar-go-sandbox-dead-drop/HighScore 67/100First seen
IP142.250.151.94LowScore 35/100First seen
IP2.22.96.50HighScore 68/100First seen
SHA2562995ffb73342453b258926ec865c724e3567eee1bb8eb35d61796ee0c4f25105HighScore 67/100First seen
MD587332fcdf79e1c0bfb7713e9a52c0313HighScore 67/100First seen
URLsteamcommunity.com/profiles/76561198777118079HighScore 67/100First seen

IOC Relationship Graph

15 total IOCs
SHA1URLIPMD5SHA256
URL7IP4MD52SHA11SHA2561Malware3Vidar V1.5 in Go: Same Family, New Language, Heavy Sandbox ChecksREPORThttps://steamcommuni…telegram.me/pr55iihttps://telegram.me/…telegram.me/dikkh0ktelegram.me/sre22qehttps://www.derp.ca/…steamcommunity.com/p…149.154.167.99135.181.237.59142.250.151.942.22.96.50702ef1b4007f07887e9f…87332fcdf79e1c0bfb77…488d2dd8768e3b804179…2995ffb73342453b2589…LummaRhadamanthysVidar
scroll to zoom · drag to pan · click IOC to open