The ThreatFox: Vidar IOCs rule detects potential command and control activity associated with the Vidar malware, leveraging known indicators to identify compromised hosts. SOC teams should proactively hunt for this behavior in Azure Sentinel to uncover stealthy, long-term persistence and exfiltration attempts by advanced adversaries.
IOC Summary
Malware Family: Vidar Total IOCs: 19 IOC Types: domain, ip:port, url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | cas.hanyasm188.top | botnet_cc | 2026-06-16 | 75% |
| url | hxxps://cas.hanyasm188.top/ | botnet_cc | 2026-06-16 | 75% |
| domain | cas.rzrrent.com | botnet_cc | 2026-06-16 | 100% |
| url | hxxps://cas.rzrrent.com/ | botnet_cc | 2026-06-16 | 100% |
| ip:port | 135[.]181[.]77[.]214:443 | botnet_cc | 2026-06-16 | 100% |
| ip:port | 178[.]105[.]230[.]82:443 | botnet_cc | 2026-06-16 | 100% |
| ip:port | 65[.]21[.]96[.]130:443 | botnet_cc | 2026-06-16 | 100% |
| url | hxxps://135[.]181[.]77[.]214/ | botnet_cc | 2026-06-16 | 100% |
| url | hxxps://178[.]105[.]230[.]82/ | botnet_cc | 2026-06-16 | 100% |
| url | hxxps://65[.]21[.]96[.]130/ | botnet_cc | 2026-06-16 | 100% |
| url | hxxps://coquinalawgroup.com/ | payload_delivery | 2026-06-16 | 75% |
| url | hxxps://sip.rzrrent.com/ | botnet_cc | 2026-06-16 | 75% |
| domain | sip.rzrrent.com | botnet_cc | 2026-06-16 | 75% |
| url | hxxps://sip.hanyasm188.top/ | botnet_cc | 2026-06-16 | 75% |
| domain | sip.hanyasm188.top | botnet_cc | 2026-06-16 | 75% |
| url | hxxps://usa.goturbo88.top/ | botnet_cc | 2026-06-15 | 75% |
| domain | usa.goturbo88.top | botnet_cc | 2026-06-15 | 75% |
| domain | usa.glamisrents.com | botnet_cc | 2026-06-15 | 100% |
| url | hxxps://usa.glamisrents.com/ | botnet_cc | 2026-06-15 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Vidar
let malicious_ips = dynamic(["65.21.96.130", "178.105.230.82", "135.181.77.214"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["65.21.96.130", "178.105.230.82", "135.181.77.214"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["cas.hanyasm188.top", "cas.rzrrent.com", "sip.rzrrent.com", "sip.hanyasm188.top", "usa.goturbo88.top", "usa.glamisrents.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://cas.hanyasm188.top/", "https://cas.rzrrent.com/", "https://135.181.77.214/", "https://178.105.230.82/", "https://65.21.96.130/", "https://coquinalawgroup.com/", "https://sip.rzrrent.com/", "https://sip.hanyasm188.top/", "https://usa.goturbo88.top/", "https://usa.glamisrents.com/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Scenario: Legitimate scheduled job for system maintenance using schtasks.exe
Filter/Exclusion: Exclude processes initiated by schtasks.exe with known maintenance task names (e.g., DailyDiskCleanup, SystemUpdateCheck)
Scenario: Admin using PowerShell to generate reports with Export-Csv
Filter/Exclusion: Exclude PowerShell scripts that use Export-Csv and are executed from known admin tools or user directories (e.g., C:\Windows\System32\WindowsPowerShell\v1.0\)
Scenario: Use of PsExec for remote administration across trusted internal hosts
Filter/Exclusion: Exclude processes launched via PsExec that connect to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
Scenario: Legitimate use of CertUtil to manage certificates on Windows servers
Filter/Exclusion: Exclude processes involving CertUtil that are initiated from certificate management tools or by domain administrators (e.g., CertUtil -addstore commands)
Scenario: Use of WMIC for system inventory collection by IT support tools
Filter/Exclusion: Exclude WMIC commands executed by known IT management tools (e.g., Microsoft System Center, SCOM, or Microsoft Endpoint Manager)