This hunt targets adversary behavior consistent with the Vidar malware family by actively searching for the presence of its specific Indicators of Compromise across the environment. Proactively hunting these 75 IOCs in Azure Sentinel is critical to identify early-stage infections and lateral movement before they escalate into significant data exfiltration or ransomware incidents.
Malware Family: Vidar Total IOCs: 75 IOC Types: url, ip:port, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxps://pressao.sinprodf.org.br/ | payload_delivery | 2026-07-20 | 75% |
| url | hxxps://academyda.co/ | payload_delivery | 2026-07-20 | 75% |
| url | hxxps://carmag.nl/ | payload_delivery | 2026-07-20 | 75% |
| url | hxxps://graduadosocialcordoba.com/ | payload_delivery | 2026-07-20 | 75% |
| ip:port | 62[.]60[.]156[.]152:443 | botnet_cc | 2026-07-20 | 100% |
| ip:port | 62[.]60[.]156[.]105:443 | botnet_cc | 2026-07-20 | 100% |
| ip:port | 167[.]233[.]225[.]221:443 | botnet_cc | 2026-07-20 | 100% |
| ip:port | 178[.]105[.]212[.]106:443 | botnet_cc | 2026-07-20 | 100% |
| ip:port | 62[.]60[.]156[.]9:443 | botnet_cc | 2026-07-20 | 100% |
| ip:port | 144[.]76[.]97[.]182:443 | botnet_cc | 2026-07-20 | 100% |
| ip:port | 62[.]60[.]148[.]253:443 | botnet_cc | 2026-07-20 | 100% |
| ip:port | 37[.]27[.]227[.]56:443 | botnet_cc | 2026-07-20 | 100% |
| ip:port | 167[.]233[.]223[.]34:443 | botnet_cc | 2026-07-20 | 100% |
| ip:port | 37[.]27[.]235[.]227:443 | botnet_cc | 2026-07-20 | 100% |
| ip:port | 65[.]108[.]197[.]198:443 | botnet_cc | 2026-07-20 | 100% |
| ip:port | 188[.]40[.]215[.]132:443 | botnet_cc | 2026-07-20 | 100% |
| ip:port | 46[.]224[.]109[.]175:443 | botnet_cc | 2026-07-20 | 100% |
| ip:port | 178[.]105[.]203[.]113:443 | botnet_cc | 2026-07-20 | 100% |
| ip:port | 62[.]60[.]156[.]150:443 | botnet_cc | 2026-07-20 | 100% |
| ip:port | 195[.]201[.]33[.]212:443 | botnet_cc | 2026-07-20 | 100% |
| ip:port | 168[.]119[.]108[.]231:443 | botnet_cc | 2026-07-20 | 100% |
| ip:port | 46[.]4[.]77[.]212:443 | botnet_cc | 2026-07-20 | 100% |
| domain | sei.loloxsm188.top | botnet_cc | 2026-07-20 | 100% |
| domain | okx.loloxsm188.top | botnet_cc | 2026-07-20 | 100% |
| domain | ylp.brslot.net | botnet_cc | 2026-07-20 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Vidar
let malicious_ips = dynamic(["62.60.148.253", "168.119.108.231", "46.4.77.212", "178.105.212.106", "37.27.235.227", "167.233.223.34", "65.108.197.198", "188.40.215.132", "62.60.156.152", "46.224.109.175", "144.76.97.182", "62.60.156.9", "62.60.156.150", "195.201.33.212", "178.105.203.113", "62.60.156.105", "37.27.227.56", "167.233.225.221"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["62.60.148.253", "168.119.108.231", "46.4.77.212", "178.105.212.106", "37.27.235.227", "167.233.223.34", "65.108.197.198", "188.40.215.132", "62.60.156.152", "46.224.109.175", "144.76.97.182", "62.60.156.9", "62.60.156.150", "195.201.33.212", "178.105.203.113", "62.60.156.105", "37.27.227.56", "167.233.225.221"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["sei.loloxsm188.top", "okx.loloxsm188.top", "ylp.brslot.net", "mgg.brslot.net", "wvg.brslot.net", "fwb.brslot.net", "h1r.brslot.net", "sei.brslot.net", "okx.brslot.net", "ylp.loloxsm188.top", "mgg.loloxsm188.top", "wvg.loloxsm188.top", "fwb.loloxsm188.top", "h1r.loloxsm188.top", "kmd.loloxsm188.top", "kmd.brslot.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://pressao.sinprodf.org.br/", "https://academyda.co/", "https://carmag.nl/", "https://graduadosocialcordoba.com/", "https://178.105.212.106/", "https://37.27.235.227/", "https://65.108.197.198/", "https://188.40.215.132/", "https://62.60.156.152/", "https://62.60.156.105/", "https://167.233.225.221/", "https://62.60.156.9/", "https://144.76.97.182/", "https://62.60.148.253/", "https://37.27.227.56/", "https://167.233.223.34/", "https://178.105.203.113/", "https://62.60.156.150/", "https://195.201.33.212/", "https://168.119.108.231/", "https://46.4.77.212/", "https://h1r.brslot.net/", "https://sei.brslot.net/", "https://okx.brslot.net/", "https://46.224.109.175/", "https://okx.loloxsm188.top/", "https://ylp.brslot.net/", "https://mgg.brslot.net/", "https://wvg.brslot.net/", "https://fwb.brslot.net/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding exclusions for the ThreatFox: Vidar IOCs detection rule in an enterprise environment:
Endpoint Protection Scanning of Quarantined Archives
\\FileServer\IT_Archives\Legacy_Installers\) and restrict alerts to only trigger on files accessed by user workstations, excluding service accounts running the EDR scanning engine.Third-Party Security Tool Updates
svc-qualys-updater) and whitelist the known SHA256 hashes of the distribution point’s extraction folder (C:\Tenable\Staging\Extracts).Administrative Deployment via Configuration Management