MalwarePublished 18 May 2026

Vidar v1.5 in Go: same family, new language, heavy sandbox checks

Source AlienVault OTX General

Description

Vidar is a name most infostealer trackers know well -- an Arkei descendant that has been snatching browser credentials and crypto wallets since 2018. It usually ships as a .NET binary or a C++ PE. The v1.5 sample we pulled from Triage on May 13, 2026 is neither. It is a 7 MB Go 1.25.4 native PE with a twelve-category sandbox scoring system, dead-drop C2 via Telegram and Steam profile pages, and enough crypto primitives to make a librarian blush.

Impact

Vidar v1.5 can steal sensitive information including browser credentials and cryptocurrency wallets, potentially leading to unauthorized access and financial loss. Its advanced sandbox evasion techniques may reduce the effectiveness of automated malware analysis and detection. The use of dead-drop C2 channels via Telegram and Steam profile pages complicates network detection and attribution. There is no indication of active widespread exploitation or targeted geographic impact at this time.

Defensive guidance

Mitigation should focus on detection and blocking using the provided indicators of compromise (IOCs), including file hashes and C2 URLs. Security teams should update endpoint detection and response (EDR) tools and network defenses to recognize these indicators. Monitoring for suspicious use of Telegram and Steam profile communications may also help identify infections. Since this is malware, standard malware removal procedures apply once detected.

Summary

Vidar v1.5 is a new iteration of the Vidar infostealer malware family, rewritten in Go rather than .NET or C++. This version includes advanced sandbox evasion via a twelve-category scoring system and uses unconventional dead-drop C2 communication through Telegram and Steam profile pages. It continues the family’s focus on stealing browser credentials and cryptocurrency wallets. The malware is a 7 MB native PE compiled with Go 1.25.4 and contains extensive cryptographic primitives. Indicators such as IP addresses, URLs, and file hashes are provided for detection.

Indicators of compromise

URLs 3

http://149.154.167.99:443
http://135.181.237.59:443
http://142.250.151.94:80

Hashes 4

702ef1b4007f07887e9faaee0667b50b
87332fcdf79e1c0bfb7713e9a52c0313MD5 of 488d2dd8768e3b804179e7f0cdcebd0a7eec52b3
488d2dd8768e3b804179e7f0cdcebd0a7eec52b3
2995ffb73342453b258926ec865c724e3567eee1bb8eb35d61796ee0c4f25105SHA256 of 488d2dd8768e3b804179e7f0cdcebd0a7eec52b3

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 18 May 2026, 19:22 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

Indicators of compromise

URLs 3

Hashes 4

Community reviews

Related threats