ThreatFox: Vidar IOCs

Hunt Hypothesis

This hunt targets the presence of Vidar infostealer indicators, which adversaries deploy to harvest sensitive credentials and browser data from compromised endpoints. Proactively hunting for these specific IOCs in Azure Sentinel allows the SOC to identify active infections and potential lateral movement before the stolen data is exfiltrated to threat actor infrastructure.

IOC Summary

Malware Family: Vidar Total IOCs: 4 IOC Types: url, sha256_hash, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["16dewaslot.org", "my.v-panel.asia"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://my.v-panel.asia/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Vidar
let malicious_hashes = dynamic(["eb5c5bd5eac25aa48887db9fcf4e028428308c3ff24041ee2990074a743d05e5"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Vidar

False Positive Guidance

• Scenario: A DevOps engineer uses PowerShell to execute a deployment script that dynamically loads a .NET assembly (e.g., System.Web.Http) containing a method named Vidar or similar, triggering the IOC match.
  • Filter/Exclusion: Exclude processes where the parent process is powershell.exe or pwsh.exe AND the command line contains Import-Module or Add-Type with known internal repository paths (e.g., \\corp-srv\devops\scripts\).
• Scenario: An IT administrator runs a standard Windows Update or patching tool (e.g., wsusutil.exe or patchmanager.exe) that temporarily creates a temporary file or mutex named Vidar during the update cycle.
  • Filter/Exclusion: Exclude events where the parent process is in the list of known patching tools (wsusutil.exe, patchmanager.exe, updateinstaller.exe) AND the event type is FileCreate or MutexCreate with a path under %TEMP% or C:\Windows\Temp.
• Scenario: A security team runs a YARA scan or memory dump analysis using a tool like Volatility or YaraScan that loads a rule file named vidar.yar or creates a temporary output file with that name.
  • Filter/Exclusion: Exclude events where the parent process is yara.exe, volatility.exe, or memdump.exe AND the file path ends with .yar, .dmp, or .txt.
• Scenario: A legacy application or custom internal tool (e.g., legacyapp.exe) uses a shared library or DLL named vidar.dll for internal data processing, which is not the malicious Vidar RAT but a coincidental naming conflict. *