ThreatFox: Vidar IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets adversaries leveraging the Vidar malware family by correlating network and host telemetry against a curated set of 18 specific Indicators of Compromise (IOCs). Proactively hunting for these signals in Azure Sentinel is critical to identify early-stage infections before they establish persistence or exfiltrate sensitive data, given Vidar’s high severity and known capabilities.

IOC Summary

Malware Family: Vidar Total IOCs: 18 IOC Types: md5_hash, sha1_hash, domain, sha256_hash, url

Type	Value	Threat Type	First Seen	Confidence
url	`hxxps://geurtuin.com/`	payload_delivery	2026-06-28	75%
url	`hxxps://engr-salahuddin.com/`	payload_delivery	2026-06-28	75%
domain	`bibliorock.lol`	botnet_cc	2026-06-28	75%
domain	`mistertwister.sale`	botnet_cc	2026-06-28	100%
domain	`memshowblob.forum`	botnet_cc	2026-06-28	100%
sha1_hash	`3eae959cc134d89dcfab4f8388569626e166be0e`	payload	2026-06-27	95%
md5_hash	`885e4c62d17993ccffbfd44a1c128ddf`	payload	2026-06-27	95%
sha256_hash	`bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773`	payload	2026-06-27	95%
sha1_hash	`b10573574be99566629f6ca88ba82d0e7e2122a7`	payload	2026-06-27	95%
md5_hash	`f269378bb7d1c7817fa6200a1198b9df`	payload	2026-06-27	95%
sha256_hash	`abb0ddc5d6972b69a938f88cbc354dffbd14adcd13b8049e6654f51dd3f5836d`	payload	2026-06-27	95%
url	`hxxps://villapescados.com.br/`	payload_delivery	2026-06-27	75%
url	`hxxps://rssssociety.org.in/`	payload_delivery	2026-06-27	75%
url	`hxxps://shootiamedia.com/`	payload_delivery	2026-06-27	75%
url	`hxxps://brightleafholdings.com/`	payload_delivery	2026-06-27	75%
url	`hxxps://nhuydecor.com/`	payload_delivery	2026-06-27	75%
url	`hxxps://villacamarao.com.br/`	payload_delivery	2026-06-27	75%
url	`hxxps://smartpos.com.tr/`	payload_delivery	2026-06-27	75%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["bibliorock.lol", "mistertwister.sale", "memshowblob.forum"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://geurtuin.com/", "https://engr-salahuddin.com/", "https://villapescados.com.br/", "https://rssssociety.org.in/", "https://shootiamedia.com/", "https://brightleafholdings.com/", "https://nhuydecor.com/", "https://villacamarao.com.br/", "https://smartpos.com.tr/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Vidar
let malicious_hashes = dynamic(["3eae959cc134d89dcfab4f8388569626e166be0e", "885e4c62d17993ccffbfd44a1c128ddf", "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773", "b10573574be99566629f6ca88ba82d0e7e2122a7", "f269378bb7d1c7817fa6200a1198b9df", "abb0ddc5d6972b69a938f88cbc354dffbd14adcd13b8049e6654f51dd3f5836d"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — Vidar

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Vidar IOCs detection rule, tailored for an enterprise environment using common security and management tools:

Endpoint Protection Definition Updates via Microsoft Defender for Endpoint
- Scenario: The scheduled daily update job for Microsoft Defender for Endpoint (or a similar EDR like CrowdStrike) downloads the latest virus definition package. This package may contain a specific DLL or executable hash that matches one of the 18 Vidar IOCs, particularly if the vendor has recently updated their signature database to include known benign components that overlap with Vidar’s infrastructure.
- Filter/Exclusion: Create an exclusion rule based on the process path and parent process. Filter for events where ProcessPath contains \Program Files\Microsoft Defender Antivirus\ (or the specific EDR vendor folder) AND ParentProcessName is MsMpEng.exe or the specific update agent service.
Automated Patch Management via SCCM/Intune Deployment
- Scenario: During a scheduled maintenance window, Microsoft Endpoint Configuration Manager (SCCM) or Intune deploys a critical security patch to workstations. The deployment package includes a temporary installer (setup.exe or msiexec) that extracts and executes a helper utility. This utility might communicate with an external repository server whose IP address or domain name is listed in the Vidar IOC set, triggering a network connection alert.
- Filter/Exclusion: Implement a filter based on scheduled task names and user context. Exclude events where TaskName matches known deployment tasks (e.g., Microsoft SCCM Client Agent, Intune Management Extension) AND the running user account is a service account (e.g., NT AUTHORITY\SYSTEM or a dedicated Patch-Deploy-SVC).
**Third-Party Backup Software