This hunt targets the presence of known Vidar IOCs to identify systems potentially compromised by this infostealer, which is frequently used to exfiltrate sensitive data such as browser credentials and cryptocurrency wallet keys. Proactively hunting for these indicators in Azure Sentinel is critical because Vidar often operates with low noise, allowing adversaries to steal assets before traditional endpoint detections trigger an alert.
Malware Family: Vidar Total IOCs: 16 IOC Types: md5_hash, sha256_hash, sha1_hash, ip:port, url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 46[.]29[.]26[.]47:443 | botnet_cc | 2026-09-06 | 75% |
| ip:port | 46[.]62[.]133[.]5:443 | botnet_cc | 2026-09-06 | 75% |
| ip:port | 46[.]29[.]26[.]48:443 | botnet_cc | 2026-09-06 | 75% |
| url | hxxps://community.fandom.com/wikia.php?controller=UserProfile&method=getUserData&format=json&userId=63771805 | botnet_cc | 2026-09-06 | 100% |
| sha1_hash | 37c70e1f167e1d0a7019ed99cc2f9e20167a9a04 | payload | 2026-09-06 | 95% |
| md5_hash | 4c09885e2609cbba14e2425e189a0222 | payload | 2026-09-06 | 95% |
| md5_hash | d2b2992e39f5ba69c4f76fa55a8504e4 | payload | 2026-09-06 | 95% |
| sha256_hash | 5ce9391ab6bbe33345a0c4fda045ff55ef0548bb7d33bffd05b9cb42db23d16e | payload | 2026-09-06 | 95% |
| sha256_hash | 56975da761c18489905a887741cbfef67f80d7e2f8d040eace9e0c5b76f15a9a | payload | 2026-09-06 | 95% |
| sha1_hash | f3a49c09ac2e1881b647e6599e6ab0719a174cb3 | payload | 2026-09-06 | 95% |
| sha256_hash | 57563715eddd2a3d404518235fea75b7828cf0933fa10fee34737b694f37154f | payload | 2026-09-06 | 95% |
| sha1_hash | e82c31031f2ee2c09886c4db5cd111d3a19f6e62 | payload | 2026-09-06 | 95% |
| md5_hash | adc82fee3ae38985c14f2c6d517e07bd | payload | 2026-09-06 | 95% |
| sha1_hash | 08768b0231afbeee3364148d27b38f5a94ad3be0 | payload | 2026-09-06 | 95% |
| md5_hash | 066e25d2197c2bdd471bb79c1355b84a | payload | 2026-09-06 | 95% |
| sha256_hash | 3c047882f1bbf5d8911e4d7103f06cf18b587602c95bf8b4b478b82a3226caea | payload | 2026-09-06 | 95% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Vidar
let malicious_ips = dynamic(["46.29.26.47", "46.29.26.48", "46.62.133.5"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["46.29.26.47", "46.29.26.48", "46.62.133.5"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://community.fandom.com/wikia.php?controller=UserProfile&method=getUserData&format=json&userId=63771805"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - Vidar
let malicious_hashes = dynamic(["37c70e1f167e1d0a7019ed99cc2f9e20167a9a04", "4c09885e2609cbba14e2425e189a0222", "d2b2992e39f5ba69c4f76fa55a8504e4", "5ce9391ab6bbe33345a0c4fda045ff55ef0548bb7d33bffd05b9cb42db23d16e", "56975da761c18489905a887741cbfef67f80d7e2f8d040eace9e0c5b76f15a9a", "f3a49c09ac2e1881b647e6599e6ab0719a174cb3", "57563715eddd2a3d404518235fea75b7828cf0933fa10fee34737b694f37154f", "e82c31031f2ee2c09886c4db5cd111d3a19f6e62", "adc82fee3ae38985c14f2c6d517e07bd", "08768b0231afbeee3364148d27b38f5a94ad3be0", "066e25d2197c2bdd471bb79c1355b84a", "3c047882f1bbf5d8911e4d7103f06cf18b587602c95bf8b4b478b82a3226caea"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceFileEvents | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Legacy Application Deployment via MSI/EXE Installers: Vidar IOCs often include specific MD5/SHA1 hashes or file paths for known Vidar droppers. In a large enterprise, legacy line-of-business applications (e.g., specialized ERP modules or hardware drivers) may be distributed via custom MSI or EXE installers that share similar hash values or reside in standard installation directories like C:\Program Files\VendorName\.
C:\Program Files\AcmeERP\) or whitelist specific MSI/EXE installer hashes used by IT asset management tools like SCCM or Intune during deployment windows.Scheduled Maintenance Jobs for Third-Party Utilities: Vidar is known to establish persistence via scheduled tasks. Legitimate third-party utilities (such as PDF converters, backup agents, or log rotation tools) may create scheduled tasks with generic names or run scripts from C:\Windows\Temp or C:\Users\Public during maintenance windows. If the IOC matches a specific scheduled task name or a script path in a temp folder, this can trigger false positives during routine maintenance.
svc_backup, svc_maintenance) or tasks whose executable path matches known third-party utility binaries (e.g., 7z.exe, logrotate.exe) executed from standard temp or public directories during defined maintenance hours.Development and Testing Environments: In development or QA environments, engineers may deploy test builds of applications or use debuggers that temporarily place executables in non-standard locations or create temporary registry keys that match Vidar’s persistence IOCs. For example, a developer testing a new plugin might place a DLL in C:\Windows\System32 or create a temporary run key for testing purposes.