ThreatFox: Vidar IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the Vidar infostealer by monitoring for specific indicators of compromise such as malicious hashes and network connections. A SOC team should proactively search for these signals in Azure Sentinel to identify early-stage infections that could lead to credential theft and lateral movement before broader impact occurs.

IOC Summary

Malware Family: Vidar Total IOCs: 13 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["m36.akasia988.net", "out.akasia988.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://book.watersendproperties.com/", "https://magrirentcar.com/", "https://m36.akasia988.net/", "https://cesarreina.com/", "https://out.akasia988.net/", "https://aware-cr1.com/api/gate", "https://bpo.akasia988.net", "https://t.me/gk6p2s", "https://mabuhayasianstore.fo/", "https://thebookkeepingcomp.org/", "https://mattressbd.com/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Vidar

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Vidar IOCs detection rule, along with tailored filters and exclusions suitable for an enterprise environment:

• Scenario: Endpoint Protection Scanning of Quarantine Archives

  • Context: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) often scan the quarantine folder where old malware definitions or archived threat logs are stored. If a Vidar-related hash exists in an archive or definition update, the scanner may trigger a detection while processing these files.
  • Filter/Exclusion: Create an exclusion rule to ignore detections originating from the specific process C:\Program Files\CrowdStrike\FalconSensor\csagent.exe (or equivalent for Defender) when accessing paths containing \Quarantine\ or \Updates\.

• Scenario: Scheduled Backup Jobs Accessing Shared Network Drives

  • Context: Automated backup solutions like Veeam Backup & Replication or Commvault frequently traverse shared network drives to archive data. If a Vidar IOC (such as a specific DLL or executable hash) is present in the source directory being backed up, the backup agent’s file access triggers the rule.
  • Filter/Exclusion: Exclude alerts where the Process Name matches vrb.exe (Veeam) or commvaultagent.exe, and the Source File Path contains \Backup\ or \Archive\.

• Scenario: IT Admin Deployment of Security Tools via SCCM

  • Context: System Center Configuration Manager (SCCM/MECM) is often used to push security updates or new agent configurations. During a deployment window, the ccmexec.exe process may extract and execute Vidar-related components (e.g., a specific IOCs manifest file), mimicking the behavior of the actual threat.