This hunt targets the presence of Vidar remote access trojan indicators, which adversaries deploy to establish persistent backdoor access and exfiltrate sensitive data from compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate infected systems before the Vidar RAT can be leveraged for lateral movement or further payload delivery within the environment.
Malware Family: Vidar Total IOCs: 31 IOC Types: ip:port, url, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxps://sm[.]1betasia.org/ | botnet_cc | 2026-09-21 | 100% |
| domain | sm.hg77.org | botnet_cc | 2026-09-21 | 100% |
| url | hxxps://sm.hg77.org/ | botnet_cc | 2026-09-21 | 100% |
| domain | sm[.]1betasia.org | botnet_cc | 2026-09-21 | 100% |
| ip:port | 178[.]105[.]215[.]94:443 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 46[.]29[.]26[.]61:443 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 2[.]29[.]59[.]97:443 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 91[.]107[.]150[.]39:443 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 91[.]107[.]157[.]201:443 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 91[.]107[.]159[.]216:443 | botnet_cc | 2026-09-21 | 100% |
| domain | ge[.]1betasia.org | botnet_cc | 2026-09-21 | 100% |
| domain | xd[.]1betasia.org | botnet_cc | 2026-09-21 | 100% |
| domain | fr[.]1betasia.org | botnet_cc | 2026-09-21 | 100% |
| domain | oi[.]1betasia.org | botnet_cc | 2026-09-21 | 100% |
| domain | ge.hg77.org | botnet_cc | 2026-09-21 | 100% |
| domain | xd.hg77.org | botnet_cc | 2026-09-21 | 100% |
| domain | go.hg77.org | botnet_cc | 2026-09-21 | 100% |
| domain | fr.hg77.org | botnet_cc | 2026-09-21 | 100% |
| domain | oi.hg77.org | botnet_cc | 2026-09-21 | 100% |
| url | hxxps://91[.]107[.]150[.]39/ | botnet_cc | 2026-09-21 | 100% |
| url | hxxps://91[.]107[.]157[.]201/ | botnet_cc | 2026-09-21 | 100% |
| url | hxxps://91[.]107[.]159[.]216/ | botnet_cc | 2026-09-21 | 100% |
| url | hxxps://go.hg77.org/ | botnet_cc | 2026-09-21 | 100% |
| url | hxxps://178[.]105[.]215[.]94/ | botnet_cc | 2026-09-21 | 100% |
| url | hxxps://steamcommunity.com/profiles/76561198639924729 | botnet_cc | 2026-09-21 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Vidar
let malicious_ips = dynamic(["178.105.215.94", "91.107.150.39", "46.29.26.61", "91.107.157.201", "2.29.59.97", "91.107.159.216"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["178.105.215.94", "91.107.150.39", "46.29.26.61", "91.107.157.201", "2.29.59.97", "91.107.159.216"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["sm.hg77.org", "sm.1betasia.org", "ge.1betasia.org", "xd.1betasia.org", "fr.1betasia.org", "oi.1betasia.org", "ge.hg77.org", "xd.hg77.org", "go.hg77.org", "fr.hg77.org", "oi.hg77.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://sm.1betasia.org/", "https://sm.hg77.org/", "https://91.107.150.39/", "https://91.107.157.201/", "https://91.107.159.216/", "https://go.hg77.org/", "https://178.105.215.94/", "https://steamcommunity.com/profiles/76561198639924729", "https://telegram.me/nts33p", "https://ge.1betasia.org/", "https://go.1betasia.org/", "https://fr.1betasia.org/", "https://ge.hg77.org/", "https://community.fandom.com/wikia.php?controller=UserProfile&method=getUserData&format=json&userId=64140772"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Legacy Application Deployment via Group Policy: The Vidar IOCs often include specific DLLs or executables (e.g., vidar.exe, vidar.dll) that may be bundled within older, unpatched third-party applications or legacy software suites. If an IT team deploys a legacy line-of-business application (e.g., an old version of a POS system or specialized engineering tool) via Group Policy Preferences, the associated binaries might match the IOC hashes or paths.
C:\Program Files\LegacyApp\bin\) or exclude processes initiated by gpupdate.exe or mstsc.exe during scheduled deployment windows.Software Update Mechanisms for Third-Party Tools: Some Vidar IOCs target specific update executables or helper scripts used by popular enterprise tools (e.g., Adobe Creative Cloud, Java Runtime Environment, or specific antivirus update agents). If these tools perform routine self-updates or background checks, their updater binaries might coincidentally match an IOC hash or filename pattern (e.g., update.exe, check.exe).
AdobeUpdateService.exe, javaw.exe, or msiexec.exe) and restrict the exclusion to specific trusted vendor directories (e.g., C:\Program Files\Adobe\, C:\Program Files\Java\).Development and Testing Environments: Developers or QA engineers may use generic filenames (e.g., test.exe, build.exe, sample.dll) that overlap with Vidar IOCs. In a CI/CD pipeline or local development environment, these files are frequently created, executed, or copied by build tools like msbuild.exe, dotnet.exe, or npm/`node.exe