Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
fc258ff7ef8632a4cc29132b406ea66c43c0dc7fbf9f7ce9b0ab016b8fd0da3a
-
Size
470KB
-
Sample
230414-2bjnwsdf7w
-
MD5
40aef4fd3ec51ba82855263dbc0ab236
-
SHA1
e93020032ca6786543f57f25eeaa6a2f0b66c9ad
-
SHA256
fc258ff7ef8632a4cc29132b406ea66c43c0dc7fbf9f7ce9b0ab016b8fd0da3a
-
SHA512
18c3d1667eb519d3021565501441294e769dad2860c7221fb35e3c88e5aa18825b67be16ea87240ef43e3b73cbac0e0077d96f5ec40e58f163e22588b9de7666
-
SSDEEP
6144:7hNuaP0bZHuCE3x17aXhz8cci5hG5+rHWcxTNO/Yt5DLVIJtmwQ4cewmlNxi:7hjP2MCE3n7arThG5ZcxTNO/YWmwD54
Static task
static1
Behavioral task
behavioral1
Sample
fc258ff7ef8632a4cc29132b406ea66c43c0dc7fbf9f7ce9b0ab016b8fd0da3a.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
vidar
3.4
e749025c61b2caca10aa829a9e1a65a1
https://steamcommunity.com/profiles/76561199494593681
https://t.me/auftriebs
-
profile_id_v2
e749025c61b2caca10aa829a9e1a65a1
-
user_agent
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0
Extracted
laplas
http://185.106.92.74
-
api_key
bc2dceabe69fa26dbf4dd8295d65e03e1990633a88c1c8410825c9266b239396
Targets
-
-
Target
fc258ff7ef8632a4cc29132b406ea66c43c0dc7fbf9f7ce9b0ab016b8fd0da3a
-
Size
470KB
-
MD5
40aef4fd3ec51ba82855263dbc0ab236
-
SHA1
e93020032ca6786543f57f25eeaa6a2f0b66c9ad
-
SHA256
fc258ff7ef8632a4cc29132b406ea66c43c0dc7fbf9f7ce9b0ab016b8fd0da3a
-
SHA512
18c3d1667eb519d3021565501441294e769dad2860c7221fb35e3c88e5aa18825b67be16ea87240ef43e3b73cbac0e0077d96f5ec40e58f163e22588b9de7666
-
SSDEEP
6144:7hNuaP0bZHuCE3x17aXhz8cci5hG5+rHWcxTNO/Yt5DLVIJtmwQ4cewmlNxi:7hjP2MCE3n7arThG5ZcxTNO/YWmwD54
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-