Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
11 IOCs
Unmasking a Multi Stage Loader: Autoit Abuse Leading to Vidar Stealer Command and Control Communication
Threat Actors
Malware Families
Excerpt
https://www.levelblue.com/blogs/spiderlabs-blog/unmasking-a-multi-stage-loader-autoit-abuse-leading-to-vidar-stealer-command-and-control-communication Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer Command-and-Control Communication By Mahadev Joshi Published: 2026-05-07 · Archived: 2026-10-14 02:00:32 UTC LevelBlue’s Security Services issues Threat Analysis reports to inform on impacting threats. The Threat Analysis reports investigate these threats and…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(6)
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →11 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 978ad86c90d85b74947bb627ec24f8bcd26812b500e82f5af202160506ac29c6 | High | Score 67/100 | First seen |
| SHA256 | fc27479ff929d846e7c5c5d147479c81e483a2ec911bd1501a53aa646a29620d | High | Score 67/100 | First seen |
| SHA256 | d4fe9f48178cdf375a3be30d17f1dc016b5861dff8683f0bb35a0ba8d44f892f | High | Score 67/100 | First seen |
| IP | 149.154.167.99 | High | Score 69/100 | First seen |
| Domain | beds.dot | High | Score 67/100 | First seen |
| Domain | swingers.dot | High | Score 67/100 | First seen |
| Domain | gz.technicalprorj.xyz | High | Score 68/100 | First seen |
| URL | https://telegram.me/sre22qe | High | Score 70/100 | First seen |
| SHA256 | 968ecf51c442ec0ff91f91689ac524e7e8e9eab0c1a2a65cf13e54cf95194efe | High | Score 67/100 | First seen |
| URL | https://steamcommunity.com/profiles/76561198777118079 | High | Score 70/100 | First seen |
| SHA256 | 881619a47b62b52305d92640cc4d4845a279c23a5a749413785fc8fcb0fdf7fb | High | Score 67/100 | First seen |
IOC Relationship Graph
Building graph…