This hunt identifies network connections to known Vidar Remote Access Trojan infrastructure, a high-severity threat often used for credential theft and lateral movement. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect compromised endpoints before the adversary establishes persistent access or exfiltrates sensitive data.
Malware Family: Vidar Total IOCs: 25 IOC Types: ip:port, domain, url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | s77.sm188dvlv.mom | botnet_cc | 2026-09-03 | 100% |
| url | hxxps://s77.sm188dvlv.mom/ | botnet_cc | 2026-09-03 | 100% |
| domain | s77[.]13balien.org | botnet_cc | 2026-09-03 | 100% |
| url | hxxps://s77[.]13balien.org/ | botnet_cc | 2026-09-03 | 100% |
| ip:port | 178[.]104[.]22[.]105:443 | botnet_cc | 2026-09-03 | 100% |
| ip:port | 2[.]29[.]29[.]217:443 | botnet_cc | 2026-09-03 | 100% |
| ip:port | 2[.]29[.]12[.]45:443 | botnet_cc | 2026-09-03 | 100% |
| domain | hot.sm188dvlv.mom | botnet_cc | 2026-09-03 | 100% |
| domain | gen.sm188dvlv.lat | botnet_cc | 2026-09-03 | 100% |
| domain | m5p.sm188dvlv.lol | botnet_cc | 2026-09-03 | 100% |
| url | hxxps://178[.]104[.]22[.]105/ | botnet_cc | 2026-09-03 | 100% |
| url | hxxps://2[.]29[.]29[.]217/ | botnet_cc | 2026-09-03 | 100% |
| url | hxxps://gen.sm188dvlv.lat/ | botnet_cc | 2026-09-03 | 100% |
| url | hxxps://for.sm188dvlv.lat/ | botnet_cc | 2026-09-03 | 100% |
| url | hxxps://cle.sm188dvlv.lol/ | botnet_cc | 2026-09-03 | 100% |
| url | hxxps://m5p.sm188dvlv.lol/ | botnet_cc | 2026-09-03 | 100% |
| url | hxxps://hot.sm188dvlv.mom/ | botnet_cc | 2026-09-03 | 100% |
| url | hxxps://fpw.sm188dvlv.mom/ | botnet_cc | 2026-09-03 | 100% |
| domain | fpw.sm188dvlv.mom | botnet_cc | 2026-09-03 | 100% |
| domain | cle.sm188dvlv.lol | botnet_cc | 2026-09-03 | 100% |
| url | hxxps://2[.]29[.]12[.]45 | botnet_cc | 2026-09-03 | 100% |
| domain | v-lan.asia | botnet_cc | 2026-09-03 | 50% |
| url | hxxps://v-lan.asia/login | botnet_cc | 2026-09-03 | 100% |
| domain | registration.v-panel.asia | botnet_cc | 2026-09-03 | 100% |
| url | hxxps://registration.v-panel.asia/ | botnet_cc | 2026-09-03 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Vidar
let malicious_ips = dynamic(["2.29.29.217", "178.104.22.105", "2.29.12.45"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["2.29.29.217", "178.104.22.105", "2.29.12.45"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["s77.sm188dvlv.mom", "s77.13balien.org", "hot.sm188dvlv.mom", "gen.sm188dvlv.lat", "m5p.sm188dvlv.lol", "fpw.sm188dvlv.mom", "cle.sm188dvlv.lol", "v-lan.asia", "registration.v-panel.asia"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://s77.sm188dvlv.mom/", "https://s77.13balien.org/", "https://178.104.22.105/", "https://2.29.29.217/", "https://gen.sm188dvlv.lat/", "https://for.sm188dvlv.lat/", "https://cle.sm188dvlv.lol/", "https://m5p.sm188dvlv.lol/", "https://hot.sm188dvlv.mom/", "https://fpw.sm188dvlv.mom/", "https://2.29.12.45", "https://v-lan.asia/login", "https://registration.v-panel.asia/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Legacy Application Maintenance: A legacy line-of-business application (e.g., an older version of a POS system or internal ERP client) uses a specific DLL or executable name that matches one of the Vidar IOCs (e.g., svchost.exe or a generic name like update.exe) located in a non-standard directory like C:\Program Files\LegacyApp\bin\.
C:\Program Files\LegacyApp\bin\ or the specific process name if it is signed by the known vendor and resides in the application’s install directory, provided the parent process is the main application executable.Scheduled Backup/Log Rotation Jobs: An enterprise scheduled task (e.g., LogCleaner or BackupRotator) runs a script or utility that temporarily creates a file with a name matching a Vidar IOC (e.g., temp.dat or backup.tmp) in a shared network drive or local temp folder (%TEMP% or C:\Logs\) during its execution window.
svc_backup) and the parent process is a recognized backup tool (e.g., VeeamBackup.exe, CommvaultAgent.exe, or robocopy.exe), or exclude the specific scheduled task name if it runs at a predictable time.Third-Party Agent Updates: A third-party security or monitoring agent (e.g., CrowdStrike Falcon, Carbon Black, or Datadog Agent) performs a self-update or component refresh, temporarily placing a new binary or configuration file with a name matching a Vidar IOC (e.g., agent.dll or falconctl.exe in a staging folder) in a location like C:\ProgramData\ or `C