ThreatFox: Vidar IOCs

Hunt Hypothesis

This rule detects the presence of Vidar infostealer indicators, which adversaries deploy to harvest sensitive data such as credentials, browser history, and cryptocurrency wallet information. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised endpoints before the stolen data is exfiltrated, thereby reducing the dwell time of this high-severity threat.

IOC Summary

Malware Family: Vidar Total IOCs: 4 IOC Types: url, sha1_hash, md5_hash, sha256_hash

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://178.104.112.188"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Vidar
let malicious_hashes = dynamic(["bedbf012561c71bb4a9a65c2984b400a", "0b5baefd7cc0b2f4ed9a537ec813ca59130fe2d88783971687d8bcfa50015ff0", "d2ef8967da190d374da416b080051a19e56f1947"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Vidar

False Positive Guidance

• Legacy Application Deployment via GPO: An enterprise IT team deploys a legacy line-of-business application (e.g., a custom .NET wrapper or a specific version of Java) across the organization using Group Policy Objects (GPOs). The deployment script copies a specific DLL or executable to a standard path like C:\Program Files\... or C:\Windows\System32\... that matches one of the Vidar IOCs (e.g., a specific hash or filename pattern).

  • Filter/Exclusion: Exclude processes or files located in standard application directories (C:\Program Files\, C:\Program Files (x86)\) if the parent process is a known deployment tool like gpupdate.exe, mofcomp.exe, or a specific SCCM/Intune agent process (CcmExec.exe).

• Scheduled Maintenance Job for Log Rotation: A system administrator creates a scheduled task (via schtasks or Task Scheduler) to run a custom PowerShell script or batch file that rotates and compresses log files in a specific directory. The script or the resulting compressed archive (e.g., logs.zip) is stored in a location that matches a Vidar IOC path or hash, particularly if the IOC is based on file location or name rather than unique behavior.

  • Filter/Exclusion: Exclude events where the parent process is Task Scheduler (taskschd.mgr or svchost.exe with the TasksSched service) and the file extension is common for logs/archives (.log, .zip, .tar.gz).

• Third-Party Agent Installation: A security or monitoring agent (e.g., CrowdStrike Falcon, Carbon Black, or a custom EDR agent) is installed or updated. The installer places a helper binary or configuration file in a non-standard location (e.g., `C:\Users\Public\