This hunt hypothesis targets Vidar malware activity by identifying credential theft and encrypted exfiltration of banking data initiated via phishing campaigns with malicious URLs. A proactive search within Azure Sentinel is critical to detect early-stage infections before sensitive system information and financial credentials are compromised, ensuring rapid containment of high-severity threats.
Malware Family: Vidar Total IOCs: 26 IOC Types: domain, url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxps://eko.sm188cuan.top/ | botnet_cc | 2026-08-14 | 100% |
| domain | eko.sm188cuan.top | botnet_cc | 2026-08-14 | 100% |
| domain | eko[.]088idr.org | botnet_cc | 2026-08-14 | 100% |
| domain | sts.sm188cuan.top | botnet_cc | 2026-08-14 | 100% |
| url | hxxps://sts.sm188cuan.top/ | botnet_cc | 2026-08-14 | 100% |
| domain | sts[.]088idr.org | botnet_cc | 2026-08-14 | 100% |
| url | hxxps://bib.sm188cuan.top/ | botnet_cc | 2026-08-14 | 100% |
| domain | bib[.]088idr.org | botnet_cc | 2026-08-14 | 100% |
| domain | bib.sm188cuan.top | botnet_cc | 2026-08-14 | 100% |
| url | hxxps://sww.sm188cuan.top/ | botnet_cc | 2026-08-14 | 100% |
| domain | sww.sm188cuan.top | botnet_cc | 2026-08-14 | 100% |
| domain | sww[.]088idr.org | botnet_cc | 2026-08-14 | 100% |
| url | hxxps://nnu.sm188cuan.top/ | botnet_cc | 2026-08-14 | 100% |
| domain | nnu.sm188cuan.top | botnet_cc | 2026-08-14 | 100% |
| url | hxxps://nnu[.]088idr.org/ | botnet_cc | 2026-08-14 | 100% |
| domain | nnu[.]088idr.org | botnet_cc | 2026-08-14 | 100% |
| url | hxxps://46[.]62[.]249[.]147 | botnet_cc | 2026-08-14 | 75% |
| url | hxxps://pod.turbo88jp.top | botnet_cc | 2026-08-14 | 100% |
| url | hxxps://46[.]62[.]206[.]27 | botnet_cc | 2026-08-14 | 100% |
| url | hxxps://ipo[.]088idr.org/ | botnet_cc | 2026-08-14 | 100% |
| domain | ipo.sm188cuan.top | botnet_cc | 2026-08-14 | 100% |
| url | hxxps://ipo.sm188cuan.top/ | botnet_cc | 2026-08-14 | 100% |
| domain | ipo[.]088idr.org | botnet_cc | 2026-08-14 | 100% |
| domain | slon12.cc | botnet_cc | 2026-08-14 | 100% |
| url | hxxps://gdo.sm188castle.top | botnet_cc | 2026-08-14 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["eko.sm188cuan.top", "eko.088idr.org", "sts.sm188cuan.top", "sts.088idr.org", "bib.088idr.org", "bib.sm188cuan.top", "sww.sm188cuan.top", "sww.088idr.org", "nnu.sm188cuan.top", "nnu.088idr.org", "ipo.sm188cuan.top", "ipo.088idr.org", "slon12.cc"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc
// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://eko.sm188cuan.top/", "https://sts.sm188cuan.top/", "https://bib.sm188cuan.top/", "https://sww.sm188cuan.top/", "https://nnu.sm188cuan.top/", "https://nnu.088idr.org/", "https://46.62.249.147", "https://pod.turbo88jp.top", "https://46.62.206.27", "https://ipo.088idr.org/", "https://ipo.sm188cuan.top/", "https://gdo.sm188castle.top", "https://gdo.beri303.org"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc
| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: Vidar IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:
Scenario: Legitimate Banking Portal Access via Phishing Simulation Tools
login.bank-sim.com vs login.real-bank.com). When users click these simulated links, the detection logic flags them as potential Vidar exfiltration attempts targeting banking credentials.*.phish-sim.corp.local) in the rule’s exclusion list. Additionally, filter out events where the User-Agent string contains known simulation tool identifiers (e.g., PhishSim-Browser).Scenario: Scheduled Credential Backup Jobs by RMM Tools
svc-rmm-backup) running on known RMM agent binaries. Exclude events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) where the destination domain matches the organization’s central management server FQDN.