Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation A cybercrime campaign combined a loader-as-a-service framework and DLL sideloading via a Go-compiled fake MpClient.dll, a novel evasion layer combination. The post Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation appeared first on Unit 42 . Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation Menu Tools ATOMs Security Consulting About Us Under Attack? Thre…

https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis

sha256:190e328ee07e3a8870b970aaddb4a0b0204ba1e5b00f74714bae42309fb565a1

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve0
md54
url0
ipv44
ipv62
sha11
domain16
sha256100
malware_token0
attack_pattern1
threat_actor_token0

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
domain	nissrv.exe	Open →
domain	ip-api.com	Open →
sha256	b830f043076a12748b6a2dc0810ece85439ee77434d991ae7d84201b09ead756	Open →
sha256	b6912c23cccc4b0964d55608916297f6978f0b38c80a4beac472004a786fcef7	Open →
ip	136.243.203.109	Open →
ip	138.199.246.13	Open →

Malware families

Allowlist token matches only.

None extracted.

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

None extracted.

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports