Vidar v1.5, Gremlin Stealer & Shai-Hulud: Multi-Vector Credential Theft Campaign

---
title: Potential Vidar Stealer v1.5 Activity
id: 8a4b2c1d-5e6f-4a7b-8c9d-0e1f2a3b4c5d
description: Detects potential activity of Vidar Stealer v1.5 written in Go, characterized by accessing Steam or Telegram configuration directories for credential theft.
status: experimental
author: Security Arsenal
date: 2026/05/20
references:
    - https://www.derp.ca/research/vidar-go-sandbox-dead-drop/
tags:
    - attack.credential_access
    - attack.collection
logsource:
    category: file_access
    product: windows
detection:
    selection:
        TargetFilename|contains:
            - '\Steam\config\'
            - '\Telegram Desktop\tdata\'
    filter_legit:
        Image|endswith:
            - '\steam.exe'
            - '\Telegram.exe'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate backup tools accessing these directories
level: high
---
title: Malicious NPM Package Installation (Shai-Hulud Copycat)
id: b5c3d2e1-6f7a-4b8c-9d0e-1f2a3b4c5d6e
description: Detects the installation of known malicious npm packages associated with the Shai-Hulud copycat worm that steals credentials and crypto.
status: experimental
author: Security Arsenal
date: 2026/05/20
references:
    - https://www.theregister.com/cyber-crime/2026/05/18/shai-hulud-copycat-hits-another-npm-package/
tags:
    - attack.initial_access
    - attack.software_supply_chain
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\npm.cmd'
        - Image|endswith: '\node.exe'
    selection_cli:
        CommandLine|contains:
            - 'chalk-tempalte'
            - '@deadcode09284814/axios-util'
            - 'axois-utils'
            - 'color-style-utils'
    condition: all of selection_*
falsepositives:
    - None (Specific malicious package names)
level: critical
---
title: Suspicious Webshell Creation via Web Server Process
id: c6d4e3f2-7a8b-5c9d-0e1f-2a3b4c5d6e7f
description: Detects potential webshell creation (Godzilla, Behinder) initiated by web server processes often exploited by UAT-8616 or The Gentlemen actors.
status: experimental
author: Security Arsenal
date: 2026/05/20
references:
    - https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/
tags:
    - attack.persistence
    - attack.t1505.003
logsource:
    category: file_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\w3wp.exe'
            - '\httpd.exe'
            - '\java.exe'
        TargetFilename|endswith:
            - '.aspx'
            - '.jsp'
            - '.php'
    filter:
        TargetFilename|contains:
            - '\inetpub\wwwroot\'
            - '\htdocs\'
    condition: selection and filter
falsepositives:
    - Legitimate web application updates
level: high

// Hunt for network connections to known C2 infrastructure from pulses
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIP in ("194.87.92.109", "176.65.139.31", "80.200.28.28", "149.154.167.99", "135.181.237.59")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteIP, RemotePort
| order by Timestamp desc

# Hunt for Vidar Stealer and Gremlin Stealer File Hashes
$targetHashes = @(
    "702ef1b4007f07887e9faaee0667b50b", # Vidar MD5
    "87332fcdf79e1c0bfb7713e9a52c0313", # Vidar MD5
    "1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f5", # Gremlin SHA256
    "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa"  # XenShell SHA256
)

$drivesToScan = @("C:\", "D:\")

Write-Host "Scanning for malicious file hashes..."

foreach ($drive in $drivesToScan) {
    if (Test-Path $drive) {
        Get-ChildItem -Path $drive -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $file = $_
            try {
                $hash = (Get-FileHash -Path $file.FullName -Algorithm MD5 -ErrorAction Stop).Hash.ToLower()
                if ($targetHashes -contains $hash) {
                    Write-Host "[ALERT] Suspicious file found: $($file.FullName) | Hash: $hash" -ForegroundColor Red
                }
            } catch {
                # Ignore errors for locked files or permission issues
            }
        }
    }
}