ThreatFox: Vidar IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activity involving the Vidar infostealer by monitoring network traffic and endpoint logs for its specific Indicators of Compromise (IOCs). A proactive search is essential in Azure Sentinel to rapidly identify early-stage infections that could lead to credential theft and lateral movement before the malware establishes persistence.

IOC Summary

Malware Family: Vidar Total IOCs: 14 IOC Types: md5_hash, url, sha1_hash, domain, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
url	`hxxps://psk.y8slot.net/`	botnet_cc	2026-08-04	100%
url	`hxxps://psk.sinism188.top/`	botnet_cc	2026-08-04	100%
domain	`psk.y8slot.net`	botnet_cc	2026-08-04	100%
domain	`psk.sinism188.top`	botnet_cc	2026-08-04	100%
domain	`bib.sinism188.top`	botnet_cc	2026-08-04	100%
url	`hxxps://bib.sinism188.top/`	botnet_cc	2026-08-04	100%
url	`hxxps://bib.y8slot.net/`	botnet_cc	2026-08-04	100%
domain	`bib.y8slot.net`	botnet_cc	2026-08-04	100%
sha1_hash	`873421118a0984c7f3a8cccac26f3bd010e70f2f`	payload	2026-08-04	95%
md5_hash	`65290a0084c07a7c3916db8bc86a16ac`	payload	2026-08-04	95%
sha256_hash	`b7fd8d6dddf0e4321dd5303ecd50d4a9d833ab4a80e0a01face12116363a8103`	payload	2026-08-04	95%
url	`hxxps://sot.tbo88men.top`	botnet_cc	2026-08-04	75%
url	`hxxps://com.y8slot.net/`	botnet_cc	2026-08-04	100%
url	`hxxps://com.sinism188.top/`	botnet_cc	2026-08-04	100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["psk.y8slot.net", "psk.sinism188.top", "bib.sinism188.top", "bib.y8slot.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://psk.y8slot.net/", "https://psk.sinism188.top/", "https://bib.sinism188.top/", "https://bib.y8slot.net/", "https://sot.tbo88men.top", "https://com.y8slot.net/", "https://com.sinism188.top/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Vidar
let malicious_hashes = dynamic(["873421118a0984c7f3a8cccac26f3bd010e70f2f", "65290a0084c07a7c3916db8bc86a16ac", "b7fd8d6dddf0e4321dd5303ecd50d4a9d833ab4a80e0a01face12116363a8103"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — Vidar

False Positive Guidance

Here are the documented false positive scenarios and corresponding exclusions for the ThreatFox: Vidar IOCs detection rule:

Scenario: Endpoint Protection Engine Updates
- Context: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently download definition updates or heuristic signatures that share hash values with known Vidar components. These updates often trigger the 14 IOCs during scheduled nightly maintenance windows.
- Suggested Filter/Exclusion: Create a rule exclusion based on the Process Name of the endpoint agent (e.g., C:\Program Files\CrowdStrike\fs_qt.exe or MsMpEng.exe) and restrict the alert to only trigger when the process is running under a non-system user context, excluding the SYSTEM account during update cycles.
Scenario: Scheduled Antivirus Scans on Shared Drives
- Context: Automated scheduled tasks (e.g., via Windows Task Scheduler) run deep scans on shared network drives containing legacy software installers or third-party vendor tools that utilize Vidar-compatible libraries. The scan process generates file access events matching the IOCs without actual malware execution.
- Suggested Filter/Exclusion: Implement a filter to exclude alerts where the Source Path matches known internal share paths (e.g., \\FileServer\LegacyApps\) and the Trigger Type is identified as a “Scheduled Task” initiated by the local administrator or a specific service account like DOMAIN\svc_backup.
Scenario: Software Deployment via Configuration Management
- Context: During mass software deployments using tools like SCCM (Microsoft Endpoint Configuration Manager) or Ansible, deployment agents extract and execute installation packages. These packages may contain Vidar-related binaries or scripts that match the detection logic during the rollout phase.
- **Suggested Filter/Ex