This hunt identifies potential compromise by Vidar, a remote access trojan, by matching known indicators of compromise across the environment. Proactively hunting for these IOCs is critical because Vidar enables adversaries to steal sensitive data and maintain persistent access, allowing the SOC to detect and isolate infected assets before the threat actor escalates privileges or exfiltrates data.
Malware Family: Vidar Total IOCs: 92 IOC Types: url, domain, ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 62[.]238[.]25[.]40:443 | botnet_cc | 2026-09-14 | 100% |
| ip:port | 95[.]216[.]174[.]89:443 | botnet_cc | 2026-09-14 | 100% |
| ip:port | 62[.]238[.]22[.]252:443 | botnet_cc | 2026-09-14 | 100% |
| ip:port | 77[.]42[.]18[.]24:443 | botnet_cc | 2026-09-14 | 100% |
| ip:port | 46[.]62[.]138[.]14:443 | botnet_cc | 2026-09-14 | 100% |
| ip:port | 46[.]62[.]145[.]171:443 | botnet_cc | 2026-09-14 | 100% |
| ip:port | 62[.]238[.]98[.]77:443 | botnet_cc | 2026-09-14 | 100% |
| ip:port | 46[.]29[.]26[.]69:443 | botnet_cc | 2026-09-14 | 100% |
| ip:port | 2[.]29[.]21[.]253:443 | botnet_cc | 2026-09-14 | 100% |
| domain | br.qq1x.org | botnet_cc | 2026-09-14 | 100% |
| domain | lb.qq1x.org | botnet_cc | 2026-09-14 | 100% |
| domain | jj[.]334v.org | botnet_cc | 2026-09-14 | 100% |
| domain | wy[.]334v.org | botnet_cc | 2026-09-14 | 100% |
| domain | qe[.]334v.org | botnet_cc | 2026-09-14 | 100% |
| domain | ro[.]334v.org | botnet_cc | 2026-09-14 | 100% |
| domain | hi[.]334v.org | botnet_cc | 2026-09-14 | 100% |
| domain | sa[.]334v.org | botnet_cc | 2026-09-14 | 100% |
| domain | vi[.]334v.org | botnet_cc | 2026-09-14 | 100% |
| domain | xp[.]334v.org | botnet_cc | 2026-09-14 | 100% |
| domain | ur[.]334v.org | botnet_cc | 2026-09-14 | 100% |
| domain | gc[.]334v.org | botnet_cc | 2026-09-14 | 100% |
| domain | bs[.]334v.org | botnet_cc | 2026-09-14 | 100% |
| domain | tp[.]334v.org | botnet_cc | 2026-09-14 | 100% |
| domain | fw[.]334v.org | botnet_cc | 2026-09-14 | 100% |
| domain | ku[.]16dewaslot.org | botnet_cc | 2026-09-14 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Vidar
let malicious_ips = dynamic(["46.29.26.69", "62.238.25.40", "77.42.18.24", "62.238.22.252", "62.238.98.77", "2.29.21.253", "46.62.145.171", "95.216.174.89", "46.62.138.14"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["46.29.26.69", "62.238.25.40", "77.42.18.24", "62.238.22.252", "62.238.98.77", "2.29.21.253", "46.62.145.171", "95.216.174.89", "46.62.138.14"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["br.qq1x.org", "lb.qq1x.org", "jj.334v.org", "wy.334v.org", "qe.334v.org", "ro.334v.org", "hi.334v.org", "sa.334v.org", "vi.334v.org", "xp.334v.org", "ur.334v.org", "gc.334v.org", "bs.334v.org", "tp.334v.org", "fw.334v.org", "ku.16dewaslot.org", "br.16dewaslot.org", "lb.16dewaslot.org", "ku.qq1x.org", "jj.146slot.org", "wy.146slot.org", "qe.146slot.org", "ro.146slot.org", "hi.146slot.org", "sa.146slot.org", "vi.146slot.org", "xp.146slot.org", "ur.146slot.org", "gc.146slot.org", "bs.146slot.org", "tp.146slot.org", "fw.146slot.org", "lb.334v.org", "mr.334v.org", "lb.146slot.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://46.29.26.69/", "https://95.216.174.89/", "https://77.42.18.24/", "https://46.62.145.171/", "https://62.238.98.77/", "https://2.29.23.78/", "https://178.104.123.239/", "https://178.104.118.80/", "https://178.104.112.1/", "https://2.29.22.60/", "https://2.28.118.174/", "https://br.16dewaslot.org/", "https://lb.16dewaslot.org/", "https://ku.qq1x.org/", "https://br.qq1x.org/", "https://lb.qq1x.org/", "https://ur.334v.org/", "https://gc.334v.org/", "https://bs.334v.org/", "https://tp.334v.org/", "https://fw.334v.org/", "https://ku.16dewaslot.org/", "https://ro.334v.org/", "https://hi.334v.org/", "https://sa.334v.org/", "https://vi.334v.org/", "https://xp.334v.org/", "https://fw.146slot.org/", "https://lb.334v.org/", "https://mr.334v.org/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
C:\Program Files\LegacyPOS\ or C:\Program Files (x86)\EngSuite\) and whitelist the specific SHA256 hashes of the known-good binaries if they are stable across deployments.patch_helper.exe, diag_tool.dll) from network shares or local temp folders that share naming conventions or hashes with Vidar IOCs.
C:\Temp\VendorSupport\ or \\fileserver\support\tools\) and consider excluding processes with specific command-line arguments typical of diagnostic tools (e.g., /diagnose, /patch, /check) if the IOC is name-based.BackupCleaner, LogRotator) that execute scripts or binaries in non-standard locations (like C:\Users\Public\ or C:\ProgramData\) to manage logs or archives, potentially matching Vidar’s file-path or hash IOCs.
Microsoft\Windows\Backup\BackupMaintenance or custom tasks like DailyLogCleanup) and whitelist specific parent processes (e.g., schtasks.exe or TaskScheduler service) if the IOC is based on process creation.