Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    file.exe

  • Size

    4.6MB

  • Sample

    230508-e1yg1sgh95

  • MD5

    3cc3c84c2b53d1af1ef32385194d9567

  • SHA1

    b39f3f126d7ce4c8d0c4e9466d442dfff1be1b2e

  • SHA256

    43283967357b7430a89b8904c8ad5022759cf0d5e9adc6505e68e95d7eebf993

  • SHA512

    f5463525fc8e98d7ab1e259578e7ba26e5512900da4daa567fec7d98349d325c8d79fd1273a2beb9e7b08b37d41f59ffaeae269417abd14ba97fe5775951e217

  • SSDEEP

    98304:OwH5CqQ9h1l2jhdslXO2NmuWnCCYUryWQ4m+zyrVxigu6LrL:xH5CqQnP8hdscKmHryWXmk4xiuf

Malware Config

Extracted

Family

vidar

Version

3.7

Botnet

50444a9e42e55764a9d1f05ed3caa653

C2

https://steamcommunity.com/profiles/76561199501059503

https://t.me/mastersbots

Attributes
  • profile_id_v2

    50444a9e42e55764a9d1f05ed3caa653

  • user_agent

    Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/112.0

Targets

    • Target

      file.exe

    • Size

      4.6MB

    • MD5

      3cc3c84c2b53d1af1ef32385194d9567

    • SHA1

      b39f3f126d7ce4c8d0c4e9466d442dfff1be1b2e

    • SHA256

      43283967357b7430a89b8904c8ad5022759cf0d5e9adc6505e68e95d7eebf993

    • SHA512

      f5463525fc8e98d7ab1e259578e7ba26e5512900da4daa567fec7d98349d325c8d79fd1273a2beb9e7b08b37d41f59ffaeae269417abd14ba97fe5775951e217

    • SSDEEP

      98304:OwH5CqQ9h1l2jhdslXO2NmuWnCCYUryWQ4m+zyrVxigu6LrL:xH5CqQnP8hdscKmHryWXmk4xiuf

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks