Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
5ff9402242153efd2dae7f24a0307d7d1d7169fad524e7d3ae199e5e078f6f37.exe
-
Size
870KB
-
Sample
221127-wg3fasbe21
-
MD5
6ff1e024abca59d664e3513fbd1c6a0d
-
SHA1
f2cebb8b286164ee134f8eb27da69f79be4076f1
-
SHA256
5ff9402242153efd2dae7f24a0307d7d1d7169fad524e7d3ae199e5e078f6f37
-
SHA512
0fa83f35df923fafbf02ba2fb026346a54a27ea77d909648a999b9f273cc11591951e4ee91d04444c73cbb71bb66090a4f7aea434439c13307aea02e0cc803ad
-
SSDEEP
24576:HBSUvThyNTrjlohVG0HvjdF8rhaRUON0tITmE:HBrhyJrjlohlN0tU
Static task
static1
Behavioral task
behavioral1
Sample
5ff9402242153efd2dae7f24a0307d7d1d7169fad524e7d3ae199e5e078f6f37.exe
Resource
win7-20220901-en
Malware Config
Extracted
vidar
55.9
1686
https://t.me/headshotsonly
https://steamcommunity.com/profiles/76561199436777531
-
profile_id
1686
Targets
-
-
Target
5ff9402242153efd2dae7f24a0307d7d1d7169fad524e7d3ae199e5e078f6f37.exe
-
Size
870KB
-
MD5
6ff1e024abca59d664e3513fbd1c6a0d
-
SHA1
f2cebb8b286164ee134f8eb27da69f79be4076f1
-
SHA256
5ff9402242153efd2dae7f24a0307d7d1d7169fad524e7d3ae199e5e078f6f37
-
SHA512
0fa83f35df923fafbf02ba2fb026346a54a27ea77d909648a999b9f273cc11591951e4ee91d04444c73cbb71bb66090a4f7aea434439c13307aea02e0cc803ad
-
SSDEEP
24576:HBSUvThyNTrjlohVG0HvjdF8rhaRUON0tITmE:HBrhyJrjlohlN0tU
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-