ThreatFox: Vidar IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of the Vidar malware by matching network and endpoint telemetry against a curated set of ten specific Indicators of Compromise (IOCs). A SOC team should proactively hunt for these signals in Azure Sentinel to identify early-stage infections that may evade standard signature-based detection, thereby preventing potential data exfiltration or lateral movement within the environment.

IOC Summary

Malware Family: Vidar Total IOCs: 10 IOC Types: md5_hash, domain, sha256_hash, sha1_hash, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["fwf.merahsm188.top", "fwf.808skor.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://fwf.merahsm188.top/", "https://fwf.808skor.org/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Vidar
let malicious_hashes = dynamic(["5a43ccbb36c23176b99cb7727d338f43319f353f", "e006cb0220146177e684c11e8548ab39", "3bb64d86bed8337443f4b6f6c981914dd7d94b6fa7b61709015f9698e13bc67c", "5cc694a33b659fb6c6e18633daea040c", "c118f7037676c76b39d05c16c337158c0d714decee91af1c44f41c899233b265", "c2b2ecfe88e5555a73cd3d893d369b1640b626bd"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Vidar

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Vidar IOCs detection rule:

• Scenario: Scheduled Antivirus Definition Updates via Microsoft Defender

  • Context: The enterprise uses Microsoft Defender for Endpoint (MDE) with a scheduled job running every morning at 02:00 to pull the latest virus definition updates. The update package often contains hash values or file paths that overlap with Vidar’s known IOCs, specifically regarding DLLs used in the scanning engine.
  • Filter/Exclusion: Create an exclusion based on the process name MpCmdRun.exe (Microsoft Defender Update Service) and the specific scheduled task path \Microsoft\Windows\Windows Defender\UpdateOnStart. Exclude any detection where the parent process is svchost.exe running under the “NetworkService” account during the defined maintenance window.

• Scenario: Deployment of Enterprise Endpoint Detection and Response (EDR) Agents

  • Context: During a quarterly rollout, the IT team deploys CrowdStrike Falcon agents using SCCM (System Center Configuration Manager). The installation package includes several components that share file hashes or network connection patterns with Vidar’s command-and-control (C2) infrastructure, triggering alerts on port 443 connections to specific IP ranges.
  • Filter/Exclusion: Implement a filter excluding detections where the process name is ccmsetup.exe or falcon-sensor.exe. Additionally, exclude network traffic originating from the SCCM distribution point server (e.g., SCCM-DP-01) connecting to known internal update repositories.

• Scenario: Automated Backup Jobs by Veeam Backup & Replication

  • Context: The nightly backup job utilizes Veeam’s “Application-Aware Processing” which injects a snapshot agent into the OS. This agent creates temporary files and establishes network