This rule detects the presence of Vidar malware, a credential-stealing tool that often establishes command-and-control channels to exfiltrate sensitive data and facilitate lateral movement. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised endpoints early, preventing attackers from leveraging stolen credentials to expand their foothold within the environment.
Malware Family: Vidar Total IOCs: 41 IOC Types: url, sha256_hash, sha1_hash, domain, md5_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | day.sm188dvlv.mom | botnet_cc | 2026-09-04 | 100% |
| url | hxxps://day.sm188dvlv.mom/ | botnet_cc | 2026-09-04 | 100% |
| domain | day[.]13balien.org | botnet_cc | 2026-09-04 | 100% |
| url | hxxps://day[.]13balien.org/ | botnet_cc | 2026-09-04 | 100% |
| domain | xi3.sm188dvlv.mom | botnet_cc | 2026-09-04 | 100% |
| url | hxxps://xi3.sm188dvlv.mom/ | botnet_cc | 2026-09-04 | 100% |
| domain | xi3[.]13balien.org | botnet_cc | 2026-09-04 | 100% |
| url | hxxps://xi3[.]13balien.org/ | botnet_cc | 2026-09-04 | 100% |
| url | hxxps://2[.]29[.]21[.]253 | botnet_cc | 2026-09-04 | 75% |
| sha256_hash | 17c6cd29b51c34627cbccb1add64fad17909d1f1e96ac374f4573281aa5dd9a1 | payload | 2026-09-04 | 95% |
| sha1_hash | 47d1583b884244b3f0134d7934d3a3a713001d6c | payload | 2026-09-04 | 95% |
| md5_hash | 4ccdc8b931c809bbeac91f5f6c682c71 | payload | 2026-09-04 | 95% |
| md5_hash | 2a132bc5b6cb45f2d5c3b12814e638c6 | payload | 2026-09-04 | 95% |
| sha256_hash | ef684ef8bf90c0d89217b3373f64253dc8056dab0dd871555e5fcabe7671cbf4 | payload | 2026-09-04 | 95% |
| sha1_hash | ad630836facc7b850ea1b91dfda96bf1cc2f3803 | payload | 2026-09-04 | 95% |
| md5_hash | afee8b1b35405c2cbf5be6ea4d515561 | payload | 2026-09-04 | 95% |
| sha256_hash | 6fe88f738adef21d9570db7f871f4f98e6f8b3e0c57f8be799d9189af46f0430 | payload | 2026-09-04 | 95% |
| sha1_hash | 5dae067a9a7e3d5021cd4b35fc625c1cacfebb5b | payload | 2026-09-04 | 95% |
| md5_hash | 0a90407c534d4c724894e337e2df1e7e | payload | 2026-09-04 | 95% |
| md5_hash | f065e0329624d88339577f27412ab883 | payload | 2026-09-04 | 95% |
| sha256_hash | 84706c26fd802c9c1f2e85a52903d4653f965c1b5ddd4d071a8fe01b686a71ca | payload | 2026-09-04 | 95% |
| sha1_hash | 607da05a382081bc08eb2cf6f76fadc0373e3f32 | payload | 2026-09-04 | 95% |
| sha1_hash | 88d21c40759aebdeffa4f5b1a70dc563adde217f | payload | 2026-09-04 | 95% |
| md5_hash | 47e247a2f6a1f42e38c83bbb2b1a3c5c | payload | 2026-09-04 | 95% |
| sha256_hash | 49b6fd5f35958e4a8d22c42a10bfabd8dcd2319d1a57b69861a5332783c17337 | payload | 2026-09-04 | 95% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["day.sm188dvlv.mom", "day.13balien.org", "xi3.sm188dvlv.mom", "xi3.13balien.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://day.sm188dvlv.mom/", "https://day.13balien.org/", "https://xi3.sm188dvlv.mom/", "https://xi3.13balien.org/", "https://2.29.21.253"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - Vidar
let malicious_hashes = dynamic(["17c6cd29b51c34627cbccb1add64fad17909d1f1e96ac374f4573281aa5dd9a1", "47d1583b884244b3f0134d7934d3a3a713001d6c", "4ccdc8b931c809bbeac91f5f6c682c71", "2a132bc5b6cb45f2d5c3b12814e638c6", "ef684ef8bf90c0d89217b3373f64253dc8056dab0dd871555e5fcabe7671cbf4", "ad630836facc7b850ea1b91dfda96bf1cc2f3803", "afee8b1b35405c2cbf5be6ea4d515561", "6fe88f738adef21d9570db7f871f4f98e6f8b3e0c57f8be799d9189af46f0430", "5dae067a9a7e3d5021cd4b35fc625c1cacfebb5b", "0a90407c534d4c724894e337e2df1e7e", "f065e0329624d88339577f27412ab883", "84706c26fd802c9c1f2e85a52903d4653f965c1b5ddd4d071a8fe01b686a71ca", "607da05a382081bc08eb2cf6f76fadc0373e3f32", "88d21c40759aebdeffa4f5b1a70dc563adde217f", "47e247a2f6a1f42e38c83bbb2b1a3c5c", "49b6fd5f35958e4a8d22c42a10bfabd8dcd2319d1a57b69861a5332783c17337", "e64b679737e28f926c390db3dd8116c6458190ee", "97523d15ec4ccd9825512b1f418b46de4c9451a5", "1a5921d3e2c44ae45de54b2c99fe25fc", "472883cf5b21f2040ecba8364a14802c654a618e1d89e1ca21ea4db48e4d10d5", "3f3521d1d3f6183820f607e760d428fad60940373e0ac9bc554b890060078f13", "a263b8211a66fb845f6243ef58d408fb43bd8e654475c0a37abd64bbc0fc8a96", "52bbd3c467c74197bafddab955353a6524f56e6b", "ed63a17067074b72457693af943a2aa6", "e7b0c848daf7c63ec9f9afc6d4e6c26aec72fb216dfbe0083ec2c969515fef4f", "79fe7cbf23c684f3bdca2263aa926a0b18cd7a2d", "520501ba8d39feee5e90c6da81c8cf2c", "1ac7aa362b8d9494c7ceb54032ac614b498e4fb5bad9154047b6e21ba3c97cc7", "c4653a9125a09df2142f7da5c89dbbc852438cb8", "a17f2fe5f5705fa899018ba64fac91c0", "3ccbad7dd7fbb5383c96afbbb21f91cb5423f1ccb2019781ab943d7971bff2a0", "515f2b66cdf458c48c6038c547862923cb22c5fc"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
svc-inventory-sync to the target domain if the User-Agent string contains LegacyInventoryClient/1.0 and the port is 80 (not 443 or 8080), or exclude the specific IP range of the vendor’s known infrastructure if it overlaps with the IOC.%APPDATA% or C:\Users\Public) before being moved.
%APPDATA% or C:\Users\Public if the parent process is powershell.exe or cmd.exe and the command line contains keywords like -CredentialAudit or -ExportToCSV, and the file extension is .log or .csv rather than .exe or .dll.C:\Users\<User>\AppData\Local\Temp\vidar_backup_tmp).
AppData\Local\Temp if