ThreatFox: Vidar IOCs

Hunt Hypothesis

This hunt detects adversary activity involving known Vidar malware indicators to identify potential command-and-control communications or file execution within the environment. A SOC team should proactively hunt for these signals in Azure Sentinel because early detection of this modular infostealer is critical to preventing data exfiltration and lateral movement before full compromise occurs.

IOC Summary

Malware Family: Vidar Total IOCs: 15 IOC Types: domain, url, ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	178[.]104[.]211[.]128:443	botnet_cc	2026-08-25	100%
ip:port	62[.]238[.]36[.]8:443	botnet_cc	2026-08-25	100%
ip:port	185[.]167[.]99[.]44:443	botnet_cc	2026-08-25	100%
domain	ibi.sm188dnsxx.top	botnet_cc	2026-08-25	100%
domain	hit.sm188dnsxx.top	botnet_cc	2026-08-25	100%
domain	ggk.sm188dnsxx.top	botnet_cc	2026-08-25	100%
domain	dor.sm188dnsxx.top	botnet_cc	2026-08-25	100%
domain	hbd.sm188dnsxx.top	botnet_cc	2026-08-25	100%
url	hxxps://hbd.sm188dnsxx.top/	botnet_cc	2026-08-25	100%
url	hxxps://178[.]104[.]211[.]128/	botnet_cc	2026-08-25	100%
url	hxxps://62[.]238[.]36[.]8/	botnet_cc	2026-08-25	100%
url	hxxps://ibi.sm188dnsxx.top/	botnet_cc	2026-08-25	100%
url	hxxps://hit.sm188dnsxx.top/	botnet_cc	2026-08-25	100%
url	hxxps://ggk.sm188dnsxx.top/	botnet_cc	2026-08-25	100%
url	hxxps://dor.sm188dnsxx.top/	botnet_cc	2026-08-25	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Vidar
let malicious_ips = dynamic(["185.167.99.44", "62.238.36.8", "178.104.211.128"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["185.167.99.44", "62.238.36.8", "178.104.211.128"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["ibi.sm188dnsxx.top", "hit.sm188dnsxx.top", "ggk.sm188dnsxx.top", "dor.sm188dnsxx.top", "hbd.sm188dnsxx.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://hbd.sm188dnsxx.top/", "https://178.104.211.128/", "https://62.238.36.8/", "https://ibi.sm188dnsxx.top/", "https://hit.sm188dnsxx.top/", "https://ggk.sm188dnsxx.top/", "https://dor.sm188dnsxx.top/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
CommonSecurityLog	Ensure this data connector is enabled
DeviceNetworkEvents	Ensure this data connector is enabled
DnsEvents	Ensure this data connector is enabled
UrlClickEvents	Ensure this data connector is enabled

References

• ThreatFox — Vidar

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: Vidar IOCs detection rule in an enterprise environment:

• Scenario: Endpoint Protection Scanning of Known Vendor Artifacts

  • Context: Enterprise EDR solutions (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon) frequently download signature updates or threat intelligence feeds from trusted vendors. If the Vidar IOCs overlap with a known vendor’s update package or if a security tool explicitly whitelists these specific hashes as part of its own telemetry pipeline, legitimate scanning processes may trigger the rule.
  • Suggested Filter: Exclude alerts where the Process Name matches MsMpEng.exe (Windows Defender) or CsFalconService.exe (CrowdStrike), and the Parent Process is a known update service like UpdateOrchestrator.exe. Additionally, add a filter to ignore events where the File Hash exists in the organization’s “Trusted Vendor” allow-list database.

• Scenario: Scheduled Administrative Backup Jobs

  • Context: Automated backup solutions (e.g., Veeam Agent for Windows, Commvault) often perform file integrity checks or hash verification on critical system directories during off-hours. If the Vidar IOCs include generic executable names or hashes that are part of the backup agent’s internal libraries, these scheduled jobs will generate hits every time they run.
  • Suggested Filter: Create an exclusion based on Scheduled Task Name (e.g., VeeamBackupService or CommServeAgent) and restrict the rule to trigger only during business hours (08:00–18:00) if the backup runs are strictly nightly. Alternatively, filter by User Account, excluding alerts generated by service accounts like NT SERVICE\VeeamTransport.

• Scenario: Software Deployment via Configuration Management Tools