Indicators of Compromise

URL

TLP:CLEAR

http://142.250.151.94:80

Vidar v1.5 in Go: same family, new language, heavy sandbox checks

75% confidence

Added

2026-05-21

SHA-256 Hash

TLP:CLEAR

2995ffb73342453b258926ec865c724e3567eee1bb8eb35d61796ee0c4f25105

Vidar v1.5 in Go: same family, new language, heavy sandbox checks

75% confidence

Added

2026-05-21

URL

TLP:CLEAR

http://135.181.237.59:443

Vidar v1.5 in Go: same family, new language, heavy sandbox checks

75% confidence

Added

2026-05-21

URL

TLP:CLEAR

http://149.154.167.99:443

Vidar v1.5 in Go: same family, new language, heavy sandbox checks

75% confidence

Added

2026-05-21

MD5 Hash

TLP:CLEAR

702ef1b4007f07887e9faaee0667b50b

Vidar v1.5 in Go: same family, new language, heavy sandbox checks

75% confidence

Added

2026-05-21

MD5 Hash

TLP:CLEAR

87332fcdf79e1c0bfb7713e9a52c0313

Vidar v1.5 in Go: same family, new language, heavy sandbox checks

75% confidence

Added

2026-05-21

SHA-1 Hash

TLP:CLEAR

488d2dd8768e3b804179e7f0cdcebd0a7eec52b3

Vidar v1.5 in Go: same family, new language, heavy sandbox checks

75% confidence

Added

2026-05-21

SHA-256 Hash

TLP:CLEAR

df21c2615bc66c369690cf35aa5a681aed1692a5255d872427a2970e2894b2e3

Chrome cookie stealer payload (ANDROSNATCH)

90% confidence

Added

2026-05-06

SHA-256 Hash

TLP:CLEAR

d19dcbb7ab91f908d70739968b14b26d7f6301069332609c78aafc0053b6a7e1

iOS cookie stealer module (COOKIESNATCH)

90% confidence

Added

2026-05-06