Skip to main content
Press slash or control plus K to focus the search. Use the arrow keys to navigate results and press enter to open a threat.
Reconnecting to live updates…

Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation

0
Medium
Published: 07/07/2026 (07/07/2026, 23:19:29 UTC)
Source: AlienVault OTX General

Description

A financially motivated campaign identified in April 2026 distributes Vidar stealer and XMRig cryptocurrency miner globally via malvertising. The attackers use password-protected archives impersonating cracked software and Go-based loaders built with the Factory-v3 framework. The malware employs evasion techniques such as rogue Authenticode certificates, file inflation with null bytes, and AMSI bypass. Vidar stealer exfiltrates browser credentials, cookies, and cryptocurrency wallets, while XMRig mines Monero. Persistence is achieved through registry changes, scheduled tasks, and startup scripts. The threat actor, known as X3D MINER, targets victims primarily in the U.S. and European Union, combining credential theft and cryptojacking for dual monetization.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 07/09/2026, 11:47:26 UTC

Technical Analysis

This campaign delivers Vidar stealer and XMRig miner via malvertising using password-protected archives that impersonate cracked software. The loaders are Go-compiled using the Factory-v3 framework. The malware uses sophisticated evasion including rogue Authenticode certificates mimicking legitimate brands, file-size inflation with null bytes to evade detection, and AMSI bypass techniques. Vidar stealer collects and exfiltrates browser credentials, cookies, and cryptocurrency wallets to command and control infrastructure. XMRig mines Monero cryptocurrency on infected hosts. Persistence mechanisms include registry modifications, scheduled tasks, and startup folder scripts. The threat actor X3D MINER targets victims mainly in the U.S. and EU, leveraging a dual monetization approach of credential theft and cryptojacking.

Potential Impact

The campaign results in theft of sensitive credentials, cookies, and cryptocurrency wallets, potentially leading to account compromise and financial loss. Additionally, infected systems are used for unauthorized cryptocurrency mining, which can degrade system performance and increase operational costs. The use of evasion techniques complicates detection and mitigation efforts.

Mitigation Recommendations

No official patch or remediation is available as this is a malware campaign rather than a software vulnerability. Defenders should block malvertising sources, educate users to avoid password-protected archives impersonating cracked software, and employ endpoint detection capable of identifying Go-based loaders, AMSI bypass, and rogue code signing certificates. Monitoring for persistence mechanisms such as suspicious registry changes, scheduled tasks, and startup scripts is recommended. Since this is not a cloud service, remediation depends on endpoint and network defenses.

Affected Countries

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Author
AlienVault
Tlp
white
References
["https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/"]
Adversary
X3D MINER
Pulse Id
6a4d89812b006d2839a4dc49
Threat Score
null

Indicators of Compromise

Hash

ValueDescriptionCopy
hashd42595b695fc008ef2c56aabd8efd68e
hash1aae8bf580c846f39c71c05898e57e88
hashd8b31f8c03e0c76ff245ed05a15ffe6c
hash03e6f4f49cec3af38bbec9ed64c195c7a85a630ec989efb3669f04a2993c1dd7
hash6b7ff061eebeb9ead8812c410247768a7ba90786aeeb1bafa6412cc5b08237b5
hashb830f043076a12748b6a2dc0810ece85439ee77434d991ae7d84201b09ead756
hash68ced9d7c1b1ff8ffb5f56c7d3f849d4fd16a1b95324426811424b40043d6d25
hashb9b6893fa6b04ee8daa29e515c08239ac5204af1a1fa2bc10006eede1b41329b
hashd6446f2803444bd2200d48a01a9ad7d487e67e8e831c9cd13f89cbfec17fd4e2
hash74df77b6a83d89fa137fd285a2efde36b1d62c00b3be81cc93df7d1e6e94837b
hashb8b5f6991a3a61083461d5269245bebf28b90934c328848ba8c1e084a5a6216c
hash95cd48130247525d8a7e966bd3fa07e9d6c39ebbe3058ecccb336f66bb8e3d1e
hash613e5314a7ded3155cdec49fd34e852e181f4651d78bd8bf3adad2f4dbf22b0d
hash8dbcde2a28a0b3de201214d7e3bd43acc97561924daa247c05c4b0536d42be85
hash634e89d8592d7c9e2bc1c098217a813947b44a4f80bc569e9a15c1e8b0864b91
hash6d49233b1fca22f3823e856e4c16749e9c45f384ea57055fead16df35b217226
hash8cb8301f664e1e42dee8b7032fa321fc
hashf732e938a8fda479886576df82c611f9540db42c
hash3e906ae47e9836a591f44d4b743e961d634a404fa8fd8bfae64f1d54c853be2b
hashb6912c23cccc4b0964d55608916297f6978f0b38c80a4beac472004a786fcef7
hash03222c6ca2f60f70b95e454141ce8e25
hash033a49eb29d1ca3979757f3263ff6417
hash056207e13f91698b94ead7c21cc5a1ba
hash3c5300ebbc140ec500d5ddc886b95cd5
hash3e177cc39048ad17dce44452666bba0e
hash4d40d9c6445cb096f24bbca6862042a7
hash5132da5f4c7c4693c7bdfbda5c047300
hash55e7443b66c9c626abe71551233e0a30
hash655393e472be5409bc0ff521aa1662de
hash6695ae857e67b6283d49c6531a253db6
hash684c8447df60b13bc258a33ed636ce93
hash70f7dc41628613af7bb16490ca6c8510
hash72633fc47f89679472f058be0177a494
hash874df2d775a5eb406bc9d2c8811ce8c7
hash8c2b728e57531e24813e628cfba3f1c5
hash8ff9f6c05dfde0ee639c36cb53cb29a5
hash92926805ef829d33fb290c44a4f7dd26
hash96bc7cf49632b140a196c50a8f0e43cc
hash99775c9078774ed124e37d089334de5b
hasha30418484257d640e670af047d8f7bca
hasha4d12dfb189162105608636e63e5b2c5
hashc10333c92889b65c3590ef2b3819b420
hashc7abe29809cd243a2dfe4d8f1c004228
hashce0f23981ef41b8be349b32e7bfb70ad
hashdc17d8e9f92d83ec92f9789f0f0d720d
hashde3c6dc21330f6c501ada99d2206e27f
hasheca863e5c96a59267878e4f9a7e32b46
hashf38a0009fac3944821ff2a2f021ab413
hash1fe42725e5471a3f365a1180f798946643924d3b
hash31538b5e35ba2ffbe3f67810c773c14c1617ba00
hash489e62c252832cdb5cacf35bd6b193aeecc816c8
hash4bd372ca29c2efa50740c9e38c72768e4521b8de
hash5131e320f190f796f73a4553d30ce24586c27976
hash58277a661d553f4dcbd8a6dce9f6a29019e3cf4b
hash5f04874433e330d74aa7c7247b543e34ca924f64
hash65f5161364a1a759cd48d3e3ae87231ef8665d26
hash6d4242a4819ea8a58ea362056f4034d408da01f0
hash7633532821c8a10f1c789071cada50023bb40ca3
hash816a01fd37bb02ed9d8276b21e4b48f9bd9ea6de
hash83829a0ed079b4723dcf53183cb53f15bda97ce0
hash854573698765139e2f48dd38f2d77f1db472d1b1
hash86e9cc2ae1e4f9366cee2377a8f5e60e076d1df2
hash88007dfcf4adb5f8841a663bd028b1420d0ca574
hashab65198ec05f5d3901ab172758770d28f52460c4
hashab92f731ab20774dfdb95664ee41a2fbafe2a284
hashaf143894658b470586693d5a716060e67a3fb06d
hashb8c97c5e65548506c06d924a0726aeeb73478399
hashb990a6434f98354026cec72f3fb7389172e80da2
hashc14085a84c19a54cca4ee38615a1bcf6f166aefa
hashcde90dbdbadc6abb4864f4ac1075e1f9d2085798
hashd03fb33f17fbfd59605f11999503eb8fb91858bb
hashd5f52f6b215444a98472a33dda156fa0f5484217
hashddd6edbf5431b814e6793d9c2ccd0d3b3d8efa8d
hashe53db7080cc07da148c633c65d59c75548f00a84
hashf61f7914bc915133422265d1a740300b73275658
hashf918003e61dedc1915433352ffd38c4cb8e4fcd3
hash097a87cfa4a5186aba3bba096866692951bde59c6f0c2e8c1c4a599246d14da8
hash0a6a67a2fc4d79ec1cd8afc5b8b7a5e69a406e53d57a7334e097c5d0644de5f6
hash15489bcd6e4602b41c9a787ec8d7ab027d5e45d400938048bb1c702ad5937980
hash169a330353e53a409e0109c914404354741ff1e1c64e501738dc05e58ea92abc
hash201594c9d173bba6cb509407ecba378c19b93da0a81a2182a913c480e6dbb54e
hash20bf39e1e67152039e70a01ad9e7b23c08d23d2a724ef9c44903f3d4353a2275
hash2a02ec4af5ed591afdf1236a443e3b68642ee133f38a2857d1eada51246ab498
hash2b7297a5f502a2e9a59066f0a370bc5a8b28addd0e27975db3d770f801c15397
hash2c0b344af415b787b396c8e23bbeb112bd471a1ca1d12cf357c48e2ee1ae068c
hash2c6e8f86c05781af12b323311e83e011f1a603928e2086c48e2ca59e33d90dbe
hash2e11a16f94484e0f43eb4572f800f26f0b4a1314cbdae3c44c1ae35f376906d8
hash2f1400a91c853d61622f4d21ed97d96ea1093c0fa1586669bea6f6baa331251f
hash314ce675c040c63b825f213965f5c76a3bd09bf70e138708367e2a84e9e84b30
hash32172e4d8d2ab9fb29b36c9b279117be6ff611b5b91ff7b1c42501a5ec969f2b
hash330efeebba3782994612fdfe20ff96c930af33a83b88a342b6622461511921b2
hash35b51bbe42edd15918b015eaa1b4f0e6b5c94f186d71d887e39f1da69a4dec3f
hash35dde1b2482b12582820a861e7c46f10721af6b75052fc872c05d2230a4e8ca1
hash3c3f12531045b7eedfe25e0f291d4792b0d8c8366f8de043e2fa8ecf34ccb913
hash3db33b0423bb9278db267a7adb036ecbd6aeebd7909d06d824919708b1e12e1b
hash43920ef7d2742d140a1ab2a1ef172c716903474c73561377dc4f1534d2c5f581
hash47d6d1a38534ba897a5a1e293e3d5df303bbd8e0526e756ad08887ffc1417bef
hash488d941b7b4428b0f4a0e5495e3857b9b96215fb3e7f164b06640d59096425e6
hash4bf770a59d367b532dec32668f86003b17d93918dba5ef5fd2b19c5394252436
hash4f456142caf590d98fb11ca247800bb417766714527e5a4707ac2f5d01542626
hash53d263b292be387843fadb7131c2d538b4262c81f5b95cfacafacf2d5446c06e
hash5494909e0f5221db75e933b28981b2d0e118f227b7d8a5980d88b500b76dfc2e
hash54dc05ab56244444f86d69b8274a6075906f7ba2307b08e08d3884abde255495
hash559f46ceb801a3540eace594476718e1486b5b4423cfb4ff64530ff8fb4a3815
hash5838ae6c748dcbdfa13c6529c654cb821897d29835d3e7e05ca23fb2f3794f02
hash59b9153c4c9e155c976db1a2fd4d1b28fa10bb9c4dcafdc4758b352c037e3d86
hash5b6a466b65d479b77a03b15a95ac097b45e23ff7ae5ef6282985b2a503deb691
hash5d7324d8b5a25f862ef8223c6766d0e80af3ad168e17312b265e13a3a68e0ded
hash62877a5096828c4bc2fca7cbee7d38b11a0c90fd0d3fc8c37981581e9988c919
hash67569adec99fd38b114ae07e2e549e6c16f75368f3c5373022c84934ed1c8e84
hash69946018ddda1058ce5c2a556c78a747838865c47074dcb165effb0840cb1cf5
hash71c79e8bf71ed257435ea9b8b91e118ba03ec681860651190f7d7457804313ee
hash739cdedb20de39aeb1f15dc8c2dbbf15fa993250fd879bf87443ff9aeaf4997b
hash7720e83c02a027d70ae201c393c1956aa2fa8199879a3a4c4fd1d20b03022cfd
hash77469615c5f548063922b469a8c0a4116511395d013e5a798e123e9c119acc4b
hash7828e17e674507ab13dfd84b31b361fa19b9cb27ee130620ba9211feef746d31
hash7e49da0ae2f81e14841f356b4d69f0480c2d9ce3fab5a3fa91b0036d9a36fa0f
hash7ed4a256e1d281cb4f194d13ff554fd4fb280dafde0a67a18115ea038ea6c87d
hash8b40cc7d173efd27fb60f3d260acef28f58d67d1f39597e1d611db311a305f62
hash901a43b42f997710147295a0625e20c935207f8c531daf5311449ec119a37dcc
hash914c18a04a2727bba9cecab78a1d516ec3c7a3f667e0e5a6081aa0e9206a69fe
hash94db6fa14b4e487dffba709b87e8a7e25483300ed409de243b19fff7cf2f0978
hash9656d3301f63ef6114289739a1c44082206298f787238fc6c190ad87eab24751
hash96bb418128deeb2b9d2e4b66b98cae07b238b326b6456cc9b86802e67c504a03
hash98cce1e69873de25e5139aa848f469bef2af345a8a49d15000b5b5e72b582896
hash9b3df1b6c1b98c201de09a7719066f7bcae6b66a3173b703a617f53fddf67d51
hasha1039de7ec690d64db9d7d91f3d777d308e49e958de4154aa0b62ded7820f1fe
hasha17a972a05afe387ed32aa2986d5be8bca2f22619d0aedfa834c6963abfab3bf
hasha4f979b4a5d7bc8bc455dd4c09b44e51a389576fccce35a2c8da3ce680237565
hasha64843ebfbc39e96ec7613003b1b5c3a9b878874ea15a05e1d34ce91781ebfb6
hasha785fc61fc4ff7cff0ddb540bf7ff12111ed0d6031f78f48387a6c16cb3c5451
hashaa0083f662f055e8d911c5de3a8f3a31b3c84cacc7dccc30c98f2be14dba4102
hashaaa2bc1128d8b8b2da76262bf87ede19bac053cca6576efba6aaa71c9438c304
hashb58814fb3ce5a085014ee6e8d89f7cc1380b234b97170fd5f3398031281c6a77
hashb927d265fa29e471c1ae0d31516e480c09c0fb17f480ad08ea8d5b73e84b7a1b
hashbb30cc2b302d9a6963109b201b78d4163bb6c2d7bc8bf5a66e9a744b62fc2717
hashbd3230e4ceaf32ad2248ab069b164bd2144401967ac69de0a4cd1734fe429d9c
hashc25799facb3e788830bcf614f33411d3bcfc0edd4a2200e160b5eb4ce700039f
hashc328b78c21060e2203ac517833fce41572b91878e187f85fa434cd6914659834
hashc39fedb662259bd76b11616966c41ff1fbda58d9b129b9c1bd818700eea92b29
hashc7a4a547eb7f6b0b4b75bb6dd8955244bb2618ba234ae740cdedd7c2d30e3465
hashc7c37a973b14edd5b6b2da4a1497c593e43640735ff54aecc9a3288fa5e548e3
hashca8a00c9d36c64e5dcf562c7ae2b8df4bd6455fe0b41b32ee3a2a528ddc2d155
hashce379de03e35e0ea2c88744c29b9e2678165214065f9b957177002c6bbe69084
hashd18369be4487d7cd0e4bd3dd0da720672e56e13ca43627305e26767e26925551
hashd2148a458da46e81702136aa915312d360805f083d1f37ff5531db9fbdb8ad6d
hashd384c403c084967d8c967501ee6332b050af04ef424f13a3f5a88d155389d98c
hashd7745513034af14617436ad6b3fc125fd0343218411d0c79bda56b0dadc86b2b
hashd78082dc33c6dca98316e865efa9829c6eb5a97c2ca3cd4ea6c2123a5f6ae45b
hashd7b56818c829960b692de9ad5a14e52669d953e9f074f7218c3fe34ede4a11a0
hashd7c9c9469c513c05aa431fae34f414f91fcf3f794d3e76b6e4d0b92c4cd3ff2e
hashd8ac0c08e4c698017558e532974cf749135d3d49757f05001e6127dc6e07cf17
hashd8c1f96107a3349e62b3ab9afc60f62af9c89b6961b637a26b71e1230f2b3b8a
hashdb2a872f712fbdb1e347d06e29a9ed8278d86710ffc14ff04422be76e47124f4
hashdccf9f008b42a04f7e69d3bbf7b5ce81e71308545d6176cc4763920a424e5ac1
hashe5341edb7c039c456d46c39f194be86ce4b41725d7ad12d297d18aa99cddd675
hashe88c41a6f769cd760e323b4f7c01835433cd4059cd59630cb1a9eb1181b350ed
hashe9e5e748ec5c0b811c8e60b0e55059edb4d2df86ff3ca45969e57d5fecb11a38
hashf0dcb7e407de85d8de8e2221df8dddecac8aec88af8975c9f07e14100f6edb88
hashf13f9cef5cc020bf673c7f4e19c93c312a043867f46796a8f01927a9a14c2533
hashf760bc16a585325ba9d74917f9e0994d3a4164c1141158c799b619d2c823e818

Ip

ValueDescriptionCopy
ip136.243.203.109
CC=DE ASN=AS24940 hetzner online gmbh
ip138.199.246.13
CC=DE ASN=ASNone
ip136.243.203.111
CC=DE ASN=AS24940 hetzner online gmbh
ip116.203.243.208
CC=DE ASN=AS24940 hetzner online gmbh

Threat ID: 6a4f86cf68715ace433d71a7

Added to database: 07/09/2026, 11:32:31 UTC

Last enriched: 07/09/2026, 11:47:26 UTC

Last updated: 07/09/2026, 23:26:22 UTC

Views: 15

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

External Links

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses