← Back to SOC feed Coverage →

ThreatFox: Vidar IOCs

ioc-hunt HIGH ThreatFox
DnsEventsUrlClickEvents
iocthreatfoxwin-vidar
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at ThreatFox →
Retrieved: 2026-08-14T11:00:00Z · Confidence: high

Hunt Hypothesis

This hunt hypothesis targets Vidar malware activity by identifying credential theft and encrypted exfiltration of banking data initiated via phishing campaigns with malicious URLs. A proactive search within Azure Sentinel is critical to detect early-stage infections before sensitive system information and financial credentials are compromised, ensuring rapid containment of high-severity threats.

IOC Summary

Malware Family: Vidar Total IOCs: 26 IOC Types: domain, url

TypeValueThreat TypeFirst SeenConfidence
urlhxxps://eko.sm188cuan.top/botnet_cc2026-08-14100%
domaineko.sm188cuan.topbotnet_cc2026-08-14100%
domaineko[.]088idr.orgbotnet_cc2026-08-14100%
domainsts.sm188cuan.topbotnet_cc2026-08-14100%
urlhxxps://sts.sm188cuan.top/botnet_cc2026-08-14100%
domainsts[.]088idr.orgbotnet_cc2026-08-14100%
urlhxxps://bib.sm188cuan.top/botnet_cc2026-08-14100%
domainbib[.]088idr.orgbotnet_cc2026-08-14100%
domainbib.sm188cuan.topbotnet_cc2026-08-14100%
urlhxxps://sww.sm188cuan.top/botnet_cc2026-08-14100%
domainsww.sm188cuan.topbotnet_cc2026-08-14100%
domainsww[.]088idr.orgbotnet_cc2026-08-14100%
urlhxxps://nnu.sm188cuan.top/botnet_cc2026-08-14100%
domainnnu.sm188cuan.topbotnet_cc2026-08-14100%
urlhxxps://nnu[.]088idr.org/botnet_cc2026-08-14100%
domainnnu[.]088idr.orgbotnet_cc2026-08-14100%
urlhxxps://46[.]62[.]249[.]147botnet_cc2026-08-1475%
urlhxxps://pod.turbo88jp.topbotnet_cc2026-08-14100%
urlhxxps://46[.]62[.]206[.]27botnet_cc2026-08-14100%
urlhxxps://ipo[.]088idr.org/botnet_cc2026-08-14100%
domainipo.sm188cuan.topbotnet_cc2026-08-14100%
urlhxxps://ipo.sm188cuan.top/botnet_cc2026-08-14100%
domainipo[.]088idr.orgbotnet_cc2026-08-14100%
domainslon12.ccbotnet_cc2026-08-14100%
urlhxxps://gdo.sm188castle.topbotnet_cc2026-08-14100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["eko.sm188cuan.top", "eko.088idr.org", "sts.sm188cuan.top", "sts.088idr.org", "bib.088idr.org", "bib.sm188cuan.top", "sww.sm188cuan.top", "sww.088idr.org", "nnu.sm188cuan.top", "nnu.088idr.org", "ipo.sm188cuan.top", "ipo.088idr.org", "slon12.cc"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://eko.sm188cuan.top/", "https://sts.sm188cuan.top/", "https://bib.sm188cuan.top/", "https://sww.sm188cuan.top/", "https://nnu.sm188cuan.top/", "https://nnu.088idr.org/", "https://46.62.249.147", "https://pod.turbo88jp.top", "https://46.62.206.27", "https://ipo.088idr.org/", "https://ipo.sm188cuan.top/", "https://gdo.sm188castle.top", "https://gdo.beri303.org"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel TableNotes
DnsEventsEnsure this data connector is enabled
UrlClickEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Vidar IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Original source: https://threatfox.abuse.ch/browse/malware/win.vidar/