This hypothesis targets the presence of Vidar remote access trojan indicators, which adversaries deploy to establish persistent, stealthy control over compromised endpoints for data exfiltration and lateral movement. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate infected assets before the threat actor can leverage the RAT to deepen their foothold within the network.
Malware Family: Vidar Total IOCs: 20 IOC Types: domain, sha256_hash, url, sha1_hash, md5_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxps://login.v-panel.asia/ | botnet_cc | 2026-09-10 | 100% |
| domain | login.v-panel.asia | botnet_cc | 2026-09-10 | 100% |
| sha256_hash | 863866fa9ffff1dd6e4d7bba34f127c9847e444078203fd2490a16fa08e91b92 | payload | 2026-09-10 | 95% |
| sha1_hash | 2477cbaf09aff57e538eb9a98ded675e23ca53a0 | payload | 2026-09-10 | 95% |
| md5_hash | 2aad0c2944754979c4ea0b0d0461efed | payload | 2026-09-10 | 95% |
| sha256_hash | 5a24a5a7e387ec5de6d8fc95e5bf455efae511d0f981605b0b232c6f6260f5cb | payload | 2026-09-10 | 95% |
| sha1_hash | 97d0345c41cd94e6c005ed7b03217bfcb351b5fe | payload | 2026-09-10 | 95% |
| md5_hash | 5e1e402e90339348be7a2a68b60f55e5 | payload | 2026-09-10 | 95% |
| sha256_hash | e686c2dcffe94fb122df2e81debdab3e3a973c9a3bfcd06854d2a99dd5605cd0 | payload | 2026-09-10 | 95% |
| sha1_hash | 48509b8456af7e787b098b157746489f48213095 | payload | 2026-09-10 | 95% |
| md5_hash | 3d305fab02241ac166687d9e3b1e1705 | payload | 2026-09-10 | 95% |
| sha1_hash | 86ceedd043ce1327474de648f09ba993094f7835 | payload | 2026-09-10 | 95% |
| md5_hash | 1e1d111b87fc523c8b46b13e0300bcc0 | payload | 2026-09-10 | 95% |
| sha1_hash | 39f1f47a0987b08dbd423eb5642163d97d541a66 | payload | 2026-09-10 | 95% |
| md5_hash | 2004d8d9525445445121fb47bbbf4b00 | payload | 2026-09-10 | 95% |
| sha256_hash | e9951dbc13b4fb5a2fe7b26783d8495131edf77b4028a8bebf25ed02beaa8b5b | payload | 2026-09-10 | 95% |
| sha256_hash | 67f1a3186b9c1e826ab34fb4c18a6a9c85bd5986e1214f80004c07c57cbfaa49 | payload | 2026-09-10 | 95% |
| sha256_hash | 7e6c18d1f36ea881e2029160438efad994040e41376e9b664858725523b659cd | payload | 2026-09-10 | 95% |
| sha1_hash | 23a8e417188fa10923dce018a278f4abdecc139e | payload | 2026-09-10 | 95% |
| md5_hash | 03ff2eb2b1d54c66b7b8ee7ad84f13c6 | payload | 2026-09-10 | 95% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["login.v-panel.asia"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://login.v-panel.asia/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - Vidar
let malicious_hashes = dynamic(["863866fa9ffff1dd6e4d7bba34f127c9847e444078203fd2490a16fa08e91b92", "2477cbaf09aff57e538eb9a98ded675e23ca53a0", "2aad0c2944754979c4ea0b0d0461efed", "5a24a5a7e387ec5de6d8fc95e5bf455efae511d0f981605b0b232c6f6260f5cb", "97d0345c41cd94e6c005ed7b03217bfcb351b5fe", "5e1e402e90339348be7a2a68b60f55e5", "e686c2dcffe94fb122df2e81debdab3e3a973c9a3bfcd06854d2a99dd5605cd0", "48509b8456af7e787b098b157746489f48213095", "3d305fab02241ac166687d9e3b1e1705", "86ceedd043ce1327474de648f09ba993094f7835", "1e1d111b87fc523c8b46b13e0300bcc0", "39f1f47a0987b08dbd423eb5642163d97d541a66", "2004d8d9525445445121fb47bbbf4b00", "e9951dbc13b4fb5a2fe7b26783d8495131edf77b4028a8bebf25ed02beaa8b5b", "67f1a3186b9c1e826ab34fb4c18a6a9c85bd5986e1214f80004c07c57cbfaa49", "7e6c18d1f36ea881e2029160438efad994040e41376e9b664858725523b659cd", "23a8e417188fa10923dce018a278f4abdecc139e", "03ff2eb2b1d54c66b7b8ee7ad84f13c6"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Legacy Application Dependency on vidar.exe or similar naming conventions: In environments where legacy line-of-business applications or older versions of specific vendor tools (e.g., certain versions of Symantec Endpoint Protection or older McAfee components) use binary names that collide with Vidar IOCs (such as vidar.exe, viral.exe, or specific hash matches in older builds), the hunt may flag these known-good binaries.
svchost.exe or vendor-specific service executables) and the binary path resides in standard vendor installation directories (e.g., C:\Program Files\Symantec\ or C:\Program Files\McAfee\).Scheduled Maintenance Jobs for Third-Party Backup or Cleanup Utilities: Some enterprise backup solutions or disk cleanup utilities (e.g., Veeam Backup & Replication agents, or Acronis True Image) may create temporary files or execute helper scripts with names or hashes that match Vidar IOCs during nightly maintenance windows. These jobs often run under the SYSTEM or Backup Service account.
Win32_Process parent or ScheduledTask trigger) and the user context is NT AUTHORITY\SYSTEM or a dedicated service account, specifically if the file path is within the vendor’s backup or staging directory (e.g., C:\Veeam\Backup\ or C:\Acronis\).Development and Testing Environments Running Vidar Samples: In DevOps or security engineering labs, analysts may intentionally run Vidar samples or test harnesses to validate detection coverage. These instances are often executed in isolated VMs or containers with predictable paths (e.g., `C:\Users