The ThreatFox: Vidar IOCs rule detects potential adversary activity associated with the Vidar malware, which is known for exfiltrating sensitive data and establishing persistence. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate advanced threats that could compromise critical systems and data.
IOC Summary
Malware Family: Vidar Total IOCs: 48 IOC Types: ip:port, url, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | gwe.utvrent.com | botnet_cc | 2026-06-22 | 100% |
| url | hxxps://gwe.utvrent.com/ | botnet_cc | 2026-06-22 | 100% |
| domain | gwe.hitamsm188.top | botnet_cc | 2026-06-22 | 100% |
| url | hxxps://gwe.hitamsm188.top/ | botnet_cc | 2026-06-22 | 100% |
| ip:port | 5[.]75[.]221[.]125:443 | botnet_cc | 2026-06-22 | 100% |
| ip:port | 91[.]98[.]109[.]24:443 | botnet_cc | 2026-06-22 | 100% |
| ip:port | 167[.]233[.]132[.]8:443 | botnet_cc | 2026-06-22 | 100% |
| url | hxxps://5[.]75[.]221[.]125/ | botnet_cc | 2026-06-22 | 100% |
| url | hxxps://91[.]98[.]109[.]24/ | botnet_cc | 2026-06-22 | 100% |
| url | hxxps://167[.]233[.]132[.]8/ | botnet_cc | 2026-06-22 | 100% |
| ip:port | 65[.]109[.]246[.]92:443 | botnet_cc | 2026-06-22 | 100% |
| ip:port | 91[.]98[.]96[.]126:443 | botnet_cc | 2026-06-22 | 100% |
| ip:port | 91[.]98[.]105[.]63:443 | botnet_cc | 2026-06-22 | 100% |
| ip:port | 91[.]98[.]106[.]140:443 | botnet_cc | 2026-06-22 | 100% |
| ip:port | 95[.]217[.]244[.]13:443 | botnet_cc | 2026-06-22 | 100% |
| ip:port | 91[.]98[.]99[.]76:443 | botnet_cc | 2026-06-22 | 100% |
| ip:port | 91[.]98[.]100[.]19:443 | botnet_cc | 2026-06-22 | 100% |
| ip:port | 95[.]217[.]244[.]189:443 | botnet_cc | 2026-06-22 | 100% |
| url | hxxps://91[.]98[.]96[.]126/ | botnet_cc | 2026-06-22 | 100% |
| url | hxxps://91[.]98[.]105[.]63/ | botnet_cc | 2026-06-22 | 100% |
| url | hxxps://91[.]98[.]106[.]140/ | botnet_cc | 2026-06-22 | 100% |
| url | hxxps://95[.]217[.]244[.]13/ | botnet_cc | 2026-06-22 | 100% |
| url | hxxps://91[.]98[.]99[.]76/ | botnet_cc | 2026-06-22 | 100% |
| url | hxxps://91[.]98[.]100[.]19/ | botnet_cc | 2026-06-22 | 100% |
| url | hxxps://95[.]217[.]244[.]189/ | botnet_cc | 2026-06-22 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Vidar
let malicious_ips = dynamic(["91.99.3.169", "95.217.244.13", "46.224.16.213", "178.104.113.24", "91.98.109.24", "167.233.132.8", "5.75.221.125", "65.109.246.92", "91.98.100.19", "167.233.131.186", "91.98.99.76", "178.104.255.247", "159.69.221.162", "91.98.106.140", "167.233.112.191", "95.217.244.189", "46.62.226.239", "91.98.105.63", "91.98.96.126"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["91.99.3.169", "95.217.244.13", "46.224.16.213", "178.104.113.24", "91.98.109.24", "167.233.132.8", "5.75.221.125", "65.109.246.92", "91.98.100.19", "167.233.131.186", "91.98.99.76", "178.104.255.247", "159.69.221.162", "91.98.106.140", "167.233.112.191", "95.217.244.189", "46.62.226.239", "91.98.105.63", "91.98.96.126"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["gwe.utvrent.com", "gwe.hitamsm188.top", "cht.hitamsm188.top", "cht.utvrent.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://gwe.utvrent.com/", "https://gwe.hitamsm188.top/", "https://5.75.221.125/", "https://91.98.109.24/", "https://167.233.132.8/", "https://91.98.96.126/", "https://91.98.105.63/", "https://91.98.106.140/", "https://95.217.244.13/", "https://91.98.99.76/", "https://91.98.100.19/", "https://95.217.244.189/", "https://65.109.246.92/", "https://91.99.3.169/", "https://178.104.255.247/", "https://159.69.221.162/", "https://178.104.113.24/", "https://167.233.112.191/", "https://steamcommunity.com/profiles/76561198684471717", "https://telegram.me/t0mdr", "https://cht.hitamsm188.top/", "https://cht.utvrent.com/", "https://46.224.16.213/", "https://46.62.226.239/", "https://167.233.131.186/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Scenario: Scheduled System Maintenance Task
Description: A legitimate scheduled task runs a script that matches one of the Vidar IOCs (e.g., a PowerShell script used for system cleanup).
Filter/Exclusion: process.name != "schtasks.exe" OR process.name != "powershell.exe" OR (process.command_line NOT LIKE "%clean%" AND process.command_line NOT LIKE "%maintenance%")
Scenario: Admin Using PsExec for Remote Management
Description: An administrator uses PsExec to run a command that matches a Vidar IOC (e.g., a remote execution command).
Filter/Exclusion: process.name != "psexec.exe" OR (process.command_line NOT LIKE "%-s%" AND process.command_line NOT LIKE "%-h%")
Scenario: Log Collection via LogParser
Description: A legitimate log collection tool like LogParser is used to query event logs, and the query string matches a Vidar IOC.
Filter/Exclusion: process.name != "logparser.exe" OR (process.command_line NOT LIKE "%-i eventlog%" AND process.command_line NOT LIKE "%-o CSV%")
Scenario: Backup Job Using Robocopy
Description: A backup job uses Robocopy to copy files, and the command line includes a path that matches a Vidar IOC.
Filter/Exclusion: process.name != "robocopy.exe" OR (process.command_line NOT LIKE "/MIR" AND process.command_line NOT LIKE "/Z")
Scenario: Software Update via Windows Update
Description: A Windows Update process downloads a file that matches a Vidar IOC due to a naming collision.
Filter/Exclusion: `process.name != “wuauserv.exe” OR (process.command_line NOT LIKE “/quiet” AND process