ThreatFox: Vidar IOCs

Hunt Hypothesis

This hypothesis targets the presence of Vidar malware indicators, a remote access trojan frequently used for credential theft and lateral movement, by correlating its known IOCs against Azure Sentinel telemetry. Proactively hunting for these signatures allows the SOC to identify compromised endpoints early, mitigating the risk of persistent backdoor access and data exfiltration before the adversary can establish a foothold in the environment.

IOC Summary

Malware Family: Vidar Total IOCs: 4 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["signin.v-panel.asia"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://178.105.213.40", "https://signin.v-panel.asia/", "https://fr.hg77.org"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Vidar

False Positive Guidance

• Scenario: A DevOps team uses WinRAR or 7-Zip to compress and encrypt application logs or backup archives for off-site storage, where the resulting archive filename or internal metadata matches one of the Vidar IOCs (e.g., specific hash values or common filenames like update.exe or svchost.exe if the IOC list includes generic names).

  • Filter/Exclusion: Exclude files located in designated backup directories (e.g., \\fileserver\backups\, C:\ProgramData\Backups\) or exclude processes originating from known compression tools (WinRAR.exe, 7z.exe) that are not running from user profile directories.

• Scenario: An IT administrator runs a legacy internal utility or installer named vidar.exe or vidar_update.exe (a common naming convention for versioned installers) from a shared network drive or local admin scripts folder during a scheduled patching cycle.

  • Filter/Exclusion: Exclude executions where the parent process is a known service management tool (e.g., Task Scheduler, SCM, PowerShell.exe with -ExecutionPolicy Bypass from a trusted path) or where the file path resides in standard admin script directories (e.g., C:\Scripts\, C:\Admin\, \\server\scripts\).

• Scenario: A security testing team or blue team conducts a tabletop exercise or red team engagement, intentionally deploying a Vidar sample or a similar RAT in an isolated test VM or non-production environment to validate detection coverage.

  • Filter/Exclusion: Exclude hosts tagged in CMDB as Environment=Test, Environment=Dev, or Role=RedTeam or exclude processes running under accounts with names like sec_test, redteam_user, or qa_admin.

• Scenario: A third