Adversaries deploy Vidar malware to establish persistence and exfiltrate credentials and sensitive data, often masquerading as legitimate processes to evade initial detection. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised endpoints and interrupt the data exfiltration pipeline before sensitive information is transmitted over encrypted channels.
Malware Family: Vidar Total IOCs: 27 IOC Types: md5_hash, sha1_hash, sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha1_hash | c8a25f150cc0d30456a26bb159458a22c3481821 | payload | 2026-09-07 | 95% |
| md5_hash | 1160591b6337e2be1ea81ccf3897f4fe | payload | 2026-09-07 | 95% |
| sha256_hash | 162172aaf538da54d65cf8bdaf9894b0e7f0f3d2810e2791b81f1257599d338e | payload | 2026-09-07 | 95% |
| sha256_hash | af8bc148eccabfa26795abff990f4cdf2dcace007af277c69d672fae76ac0f11 | payload | 2026-09-07 | 95% |
| sha1_hash | e66268079ec8369257d6a33efafcc9f359ef9f82 | payload | 2026-09-07 | 95% |
| md5_hash | 8a7d6f695e9ed0aecd02a88973cafa3c | payload | 2026-09-07 | 95% |
| md5_hash | 13217093db647aaa85a1db7c417c7b6e | payload | 2026-09-07 | 95% |
| sha1_hash | afbd45231c309a9a93a561a49a3c6f1cb8e57bf6 | payload | 2026-09-07 | 95% |
| md5_hash | 3f91088f26da199f685fc3e2b491054b | payload | 2026-09-07 | 95% |
| sha256_hash | b9fe4eb683f73621bf55f2161860b8e08af16238961e8948001a4b3c97862396 | payload | 2026-09-07 | 95% |
| sha1_hash | 2fa012dc5d5287bebafce71773736dbe7a38fc70 | payload | 2026-09-07 | 95% |
| sha1_hash | 72a759a56a7c0ee85f88749a44eb3c4c8b40b1c8 | payload | 2026-09-07 | 95% |
| md5_hash | 64cb0749ab029571b9ebef8eac5d2cc8 | payload | 2026-09-07 | 95% |
| sha256_hash | 666694cd6efbc6f8be5c3464868aaf83e5d7a6d0f1ab49eb2ed7baa168d9947a | payload | 2026-09-07 | 95% |
| sha1_hash | 966a966325aaa33d9e5128ecd322278d8ce11cb8 | payload | 2026-09-07 | 95% |
| md5_hash | 0676d9d2c18332177ea617f8ea6263b7 | payload | 2026-09-07 | 95% |
| sha256_hash | b5f7d1d7e1ebc9dbbea74f2544bf99be9891b6925ba0c2d9f56f68170328f9a0 | payload | 2026-09-07 | 95% |
| md5_hash | 5512b064ee408840eb677f85d3d2daf5 | payload | 2026-09-07 | 95% |
| sha256_hash | f8f82732198335049d00627638d4100a4e2354de61268109228585ae349df9e1 | payload | 2026-09-07 | 95% |
| sha256_hash | 5b73a1a0d19d42c9f8ac1fd862779bb1ce19d40c4b98e8c644c3303ccc36cc6d | payload | 2026-09-07 | 95% |
| sha1_hash | 9f07cd38b99e89a58dbfe66abd4ede93bff4838d | payload | 2026-09-07 | 95% |
| sha256_hash | d5713204caa252932f25e7841fd55d1b2df558eaaa249b38b376816d9da2c886 | payload | 2026-09-07 | 95% |
| sha1_hash | 8d22bfb14b116368e1b4342b57c01b2595b532b6 | payload | 2026-09-07 | 95% |
| md5_hash | 03e0d7760de00767b991b113ff77bff6 | payload | 2026-09-07 | 95% |
| sha1_hash | 7f8b53255dc2bf8c9b3fa4e243ec06e89092f98a | payload | 2026-09-07 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - Vidar
let malicious_hashes = dynamic(["c8a25f150cc0d30456a26bb159458a22c3481821", "1160591b6337e2be1ea81ccf3897f4fe", "162172aaf538da54d65cf8bdaf9894b0e7f0f3d2810e2791b81f1257599d338e", "af8bc148eccabfa26795abff990f4cdf2dcace007af277c69d672fae76ac0f11", "e66268079ec8369257d6a33efafcc9f359ef9f82", "8a7d6f695e9ed0aecd02a88973cafa3c", "13217093db647aaa85a1db7c417c7b6e", "afbd45231c309a9a93a561a49a3c6f1cb8e57bf6", "3f91088f26da199f685fc3e2b491054b", "b9fe4eb683f73621bf55f2161860b8e08af16238961e8948001a4b3c97862396", "2fa012dc5d5287bebafce71773736dbe7a38fc70", "72a759a56a7c0ee85f88749a44eb3c4c8b40b1c8", "64cb0749ab029571b9ebef8eac5d2cc8", "666694cd6efbc6f8be5c3464868aaf83e5d7a6d0f1ab49eb2ed7baa168d9947a", "966a966325aaa33d9e5128ecd322278d8ce11cb8", "0676d9d2c18332177ea617f8ea6263b7", "b5f7d1d7e1ebc9dbbea74f2544bf99be9891b6925ba0c2d9f56f68170328f9a0", "5512b064ee408840eb677f85d3d2daf5", "f8f82732198335049d00627638d4100a4e2354de61268109228585ae349df9e1", "5b73a1a0d19d42c9f8ac1fd862779bb1ce19d40c4b98e8c644c3303ccc36cc6d", "9f07cd38b99e89a58dbfe66abd4ede93bff4838d", "d5713204caa252932f25e7841fd55d1b2df558eaaa249b38b376816d9da2c886", "8d22bfb14b116368e1b4342b57c01b2595b532b6", "03e0d7760de00767b991b113ff77bff6", "7f8b53255dc2bf8c9b3fa4e243ec06e89092f98a", "d81ad96bbbf69cef390f21f5764b55fc", "2ba62876a788dd9f1541c8bd92dee4c7a235cd550a6320e2d52b88929de7ed8e"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses a legitimate version of the Vidar build tool (or a similarly named binary in a CI/CD pipeline) to compile and package a new microservice. The binary is signed by the internal CA and resides in the standard /opt/build-tools/ directory, but its hash matches a known Vidar IOC due to a shared library dependency or a generic naming convention.
C:\Program Files\Jenkins\workspace\*, /opt/ci/builds/*) or exclude binaries with a valid internal code signing certificate where the issuer matches the organization’s internal CA.Scenario: An IT administrator performs a scheduled maintenance task using a third-party credential manager or backup utility (e.g., CyberArk, Datto, or Acronis) that uses a helper executable named vidar.exe or contains a module with that name to handle encryption keys. This occurs during a standard weekend patching window.
svc_backup, admin_maintenance) or exclude executions where the parent process is a known backup/credential management service (e.g., cyberark_agent.exe, datto_service.exe).Scenario: A security team conducts a tabletop exercise or a controlled phishing simulation campaign. They deploy a test payload based on the Vidar source code to validate detection coverage. The payload is intentionally unsigned and runs from a temporary directory (%TEMP% or C:\Users\Public\) to mimic real-world behavior.
Security_Team_Sim) or where the process creation time aligns with a documented change ticket ID in the CMDB.