Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    312KB

  • Sample

    230615-zqz83sbc83

  • MD5

    1b1a0a90ae41567cf14abd205e7dec5f

  • SHA1

    6cebd394a334823c5d1d171481759257010d2248

  • SHA256

    2828697e13a2357b6fd3bdb56f036037d66cd858844fc478da9a22f9a51dcbfb

  • SHA512

    62e60550b4ca707680cb733dd768c4bf8566ff97b4629c936c1e8fb23cbc682726dd4eb58b207c02e4fe7cc442bef1d1f8c5b34a890063b411d46b783982de03

  • SSDEEP

    6144:Vv0pmumwZaRmSN3/2iHCOiYbUGLcQ+/sf5dPnlnbIoH:Vcpm5mgEOt4fQ+CPnp

Score
10/10
vidarc843bbc9de2edce7a51ceff3be8cb258discoveryspywarestealer

Malware Config

Extracted

Family

vidar

Version

4.3

Botnet

c843bbc9de2edce7a51ceff3be8cb258

C2

https://steamcommunity.com/profiles/76561199514261168

https://t.me/kamaprimo
Attributes
  • profile_id_v2

    c843bbc9de2edce7a51ceff3be8cb258

  • user_agent

    Mozilla/5.0 (Linux; U; Tizen 2.0; en-us) AppleWebKit/537.1 (KHTML, like Gecko) Mobile TizenBrowser/2.0

Targets

    • Target

      file.exe

    • Size

      312KB

    • MD5

      1b1a0a90ae41567cf14abd205e7dec5f

    • SHA1

      6cebd394a334823c5d1d171481759257010d2248

    • SHA256

      2828697e13a2357b6fd3bdb56f036037d66cd858844fc478da9a22f9a51dcbfb

    • SHA512

      62e60550b4ca707680cb733dd768c4bf8566ff97b4629c936c1e8fb23cbc682726dd4eb58b207c02e4fe7cc442bef1d1f8c5b34a890063b411d46b783982de03

    • SSDEEP

      6144:Vv0pmumwZaRmSN3/2iHCOiYbUGLcQ+/sf5dPnlnbIoH:Vcpm5mgEOt4fQ+CPnp

    Score
    10/10
    vidarc843bbc9de2edce7a51ceff3be8cb258discoveryspywarestealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks