Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

Setup.exe

windows7-x64

10

Setup.exe

windows10-2004-x64

10

WCLDll.dll

windows7-x64

1

WCLDll.dll

windows10-2004-x64

1

msvcp140.dll

windows7-x64

3

msvcp140.dll

windows10-2004-x64

3

ptMgr.dll

windows7-x64

1

ptMgr.dll

windows10-2004-x64

3

ptusredt.dll

windows7-x64

1

ptusredt.dll

windows10-2004-x64

1

vcruntime140.dll

windows7-x64

3

vcruntime140.dll

windows10-2004-x64

3

wbxtrace.dll

windows7-x64

1

wbxtrace.dll

windows10-2004-x64

3

x64/Templa...te.htm

windows7-x64

1

x64/Templa...te.htm

windows10-2004-x64

1

x64/plugin...ns.dll

windows7-x64

1

x64/plugin...ns.dll

windows10-2004-x64

1

x64/plugin...ns.dll

windows7-x64

1

x64/plugin...ns.dll

windows10-2004-x64

1

x64/plugin...ns.dll

windows7-x64

1

x64/plugin...ns.dll

windows10-2004-x64

1

x64/plugin...ns.dll

windows7-x64

1

x64/plugin...ns.dll

windows10-2004-x64

1

x64/plugin...re.dll

windows7-x64

1

x64/plugin...re.dll

windows10-2004-x64

1

x64/plugin...po.dll

windows7-x64

1

x64/plugin...po.dll

windows10-2004-x64

1

x64/plugin...ns.dll

windows7-x64

1

x64/plugin...ns.dll

windows10-2004-x64

1

x64/plugin...ns.dll

windows7-x64

1

x64/plugin...ns.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    @#!AcTive_4488_PaSṣWṏrD#$.zip

  • Size

    20.2MB

  • Sample

    240314-f8rvwadh76

  • MD5

    7e0bbc6f11c7fddea7def49799727c17

  • SHA1

    bccadb596196d29758da840ced8301b8ff729c68

  • SHA256

    0e58aee5347ec13bc8c760cb266ba8714b208581e87ea08fe4693f3ba60261d7

  • SHA512

    df7ab38c5a73952c7fc4506357bf379c6ce0e60a130b26ec14ff457ffbba5fd89c616df2ba38904fb504cc2b654724e40d6b6e78702f49911cd980dfa124c0bb

  • SSDEEP

    393216:aaHrZDcR94yYDpqAyt8aRadJhxIH2j2WiE0ygBvNR/mmuuDsU/yW:an9r8asxu2KWdMmbu4U/yW

Score
10/10
vidar8f9b46cf1d8abd40fa96d1b9e9e32173stealer

Malware Config

Extracted

Family

vidar

Botnet

8f9b46cf1d8abd40fa96d1b9e9e32173

C2

https://116.202.4.240

https://steamcommunity.com/profiles/76561199651834633

https://t.me/raf6ik
Attributes
  • profile_id_v2

    8f9b46cf1d8abd40fa96d1b9e9e32173

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0

Targets

    • Target

      Setup.exe

    • Size

      202KB

    • MD5

      64179e64675e822559cac6652298bdfc

    • SHA1

      cceed3b2441146762512918af7bf7f89fb055583

    • SHA256

      c26db97858c427d92e393396f7cb7f9e7ed8f9ce616adcc123d0ec6b055b99c9

    • SHA512

      ef740b35ea5190f8ee47776af1f15ebdd54d39c84da5665e64f67ae6dd0f4b181e955e9a35319a5d0bd764972562e8f2bc44dbdf83c3bedf05674eae902e7280

    • SSDEEP

      3072:EMtKztOp6KfOQqoY3ltdNjlcwsSdplkrxf+Uyecgw:ELKfOQLY3l9jlcwnlUf+z7gw

    Score
    10/10
    vidar8f9b46cf1d8abd40fa96d1b9e9e32173stealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      WCLDll.dll

    • Size

      590KB

    • MD5

      9005812bebfcc98db95def5b1c9b96f0

    • SHA1

      d85f085c59fe8cca75352399ebc8510e2799bf68

    • SHA256

      8acf6eea851ccd43a33eee9840794b9944eed61e5be0a7c403b79d3baa48940c

    • SHA512

      c25c4eaef2d40d5294fcd2b15f3065cb3c6cad19cc5c32da4a81b20d99023dbfcccfa5fbc2d79f45892f7d858c04d956f1734d0359054fae9e609a5d604ab0b1

    • SSDEEP

      12288:i+Se970XqzxUmUkVakh1d4wJjfXB7w86ywKUc6A9iSOJ7zP8cl7ksEjwdA9iOaQ:ce97qqzxXUkckh1d4wJjfB8vywKUc6A7

    Score
    1/10
    behavioral3behavioral4

    • Target

      msvcp140.dll

    • Size

      427KB

    • MD5

      71a0aa2d05e9174cefd568347bd9c70f

    • SHA1

      cb9247a0fa59e47f72df7d1752424b33a903bbb2

    • SHA256

      fdb3d86c512adff90967cb860d02a4682850ab96727f0376e4d4836504c50e47

    • SHA512

      6e65520528facaa4058720eb16d6bfdcc7bb36923b7e8e6551f3526709f0fabafab123999e618438e6abe7efed4a1332547cfc988f2b24b0e3d91198b95a911a

    • SSDEEP

      12288:bBsEzAVPIODrCdVgI7bwv674dOzhUgiW6QR7t5s03Ooc8dHkC2esy2n:9s8AVwOU7bwTdt03Ooc8dHkC2en2n

    Score
    3/10
    behavioral5behavioral6

    • Target

      ptMgr.dll

    • Size

      2.5MB

    • MD5

      2087eb2d3fb639933ebe0a0614fd5218

    • SHA1

      c1a1b75c8e76e000b7045092bd11100904a72840

    • SHA256

      725f50650cb9490027b633a1ff0ae166cb6fc42037dbe72d9a09dd65be323a1f

    • SHA512

      3390536ed543529d01ed7d1616d36d6fde67d68bf6641f901ac5c081ede043943dacd3a7a0bf1729945be800d4ccda00c07511e1c23c7c33d9864be50645502e

    • SSDEEP

      49152:LvSyYrklCgEFFKYy3Hlll43MkyoYh0iXGu2B1BIthEjlI0UZhQZZmRvCH:GEkglDlH1VZ0uGu2lIQ

    Score
    3/10
    behavioral7behavioral8

    • Target

      ptusredt.dll

    • Size

      165KB

    • MD5

      3c3e960d59cb413791fee1e944b6df72

    • SHA1

      4aa6c90d81692642ca8266bf0d8e249ff3e3ad54

    • SHA256

      88378c228d7827974fe6ec827837af7571290e129082e7070d4bff7a42f4ba67

    • SHA512

      85b471aa2a066c6a779384ed102b895af108af51cd718bb834cda107f71bf5e6fcd8ecc77e9ea4fd7fd3ddbc10b1f57870a9bafcbbfa1be8e2ba224651d77aac

    • SSDEEP

      3072:Ze0HJrRJW9+tjxQGsfzeV0YuNmu5uWj5ONq/1epLcv60H9+v:8SrRJGeNsry0hmuqRoy0H9u

    Score
    1/10
    behavioral10behavioral9

    • Target

      vcruntime140.dll

    • Size

      81KB

    • MD5

      16b26bc43943531d7d7e379632ed4e63

    • SHA1

      565287de39649e59e653a3612478c2186096d70a

    • SHA256

      346f72c9a7584c2ab6ce65cd38a616c77ebddc0bbab2274c4e89dd5e62237517

    • SHA512

      b5b7b4b8c5ab4276a34956e43f586272b1803ec3609253fee1bcc0a549aed7ba11d47404b023f7b67af701726bab95cca55738e7bd5bca272eca5ac71bb418cc

    • SSDEEP

      1536:BDpX0WKXQn6s8/oB6xMSKgS9WnESDPIYMWC/q6mYIeTsu03/huecbFWzZoi:BF0ZQnm/oBab8y6mfe0vhuecbFWzZoi

    Score
    3/10
    behavioral11behavioral12

    • Target

      wbxtrace.dll

    • Size

      103KB

    • MD5

      530af153319a8254261d2de81b40cfe7

    • SHA1

      63c7fb08e4dfe1e1cbd40a0fb333472822daa60a

    • SHA256

      098e8c03cfb1bc11bd7176326a36d07d1dc282f5acd78a272289afd16b7506b3

    • SHA512

      6a5998ffa86813d2825811ae9ebe2b5f43b26d02aae73395d720c83f89820af2006a93737356b138a5d736f2364a60abed5195692d58bf1866727727ab654805

    • SSDEEP

      1536:3AIwJ6nSNBZVPzq8HpWt6/wemSMUQnToIf2T9U/huhAmJ8dDUfH:3jSNBHUt6/wgMUkTBf2hU/huhFJwM

    Score
    3/10
    behavioral13behavioral14

    • Target

      x64/Templates/TemplateCorreoCliente.htm

    • Size

      2KB

    • MD5

      ce4c1f3ba9e690c4119e8ed39aa8eb78

    • SHA1

      dc2da00c92b51431c01c5e598de4665c9989e856

    • SHA256

      e17621dc67919e53a0d1be6a03fa0d97f01c8932f8d8912d556327e620310432

    • SHA512

      daf95e6329b060fe230096fc7a594cf0a13801e2dcf9869affa5530a2d03bf6c0dd2d9340be5c312b82d41dad48057f86811a23b23fba93b0dc9a478986ac4ef

    Score
    1/10
    behavioral15behavioral16

    • Target

      x64/plugins/MahApps.Metro.IconPacks.BootstrapIcons.dll

    • Size

      2.1MB

    • MD5

      8a999c6c4b38e3afef0b54cbd84180c6

    • SHA1

      991b865b6dca9ead7d47dfb22faf584fea276044

    • SHA256

      73e67b8a6607064c314b0a5d72def055ae0599beae1e7073d7a10626543d7fd0

    • SHA512

      030fcb028335a62ea7c05053835c09016643bc2a941537a7a3dd97913cbc7f6c501e6ad3fb24fda4064d5ed08ed59702d911d7c9aa3f840e12e6db843464236d

    • SSDEEP

      6144:CTuzE29sK1y7RQNsMse5AV54EFdxtkYVBQoahtxDfzjADAW4vBM9jd2e+pT9IaRr:4uzEBA

    Score
    1/10
    behavioral17behavioral18

    • Target

      x64/plugins/MahApps.Metro.IconPacks.BoxIcons.dll

    • Size

      2.0MB

    • MD5

      c01837735db98ade25e996c8fec33bf6

    • SHA1

      626cc39c077942f70b72795e999a14d8729a7298

    • SHA256

      7b28873c6b729262f6f02ff2da46ca4aeaebcf3799eabd460bfbbf4a0fcf01ca

    • SHA512

      6bce692e3bc1304b518a9b47244af4e689ab81362906c3cebf732db0eced533bbf5c9f3a779614f6b258e087b7cbe762a37a68373b4749f7c30ec330984a6f05

    • SSDEEP

      12288:NbuZ0HSkOZo/IMCPY3sgUVhv9Rhz4iamcXw9320uVBi0KwxWjYyF:o

    Score
    1/10
    behavioral19behavioral20

    • Target

      x64/plugins/MahApps.Metro.IconPacks.Codicons.dll

    • Size

      559KB

    • MD5

      7f92130abd27092c78a3e075334bb75e

    • SHA1

      14f0cf7594d998d35762e7ada89143601b222613

    • SHA256

      a22950cc45540743ac0feae232c4cffeb25baa54ac3604765907e849ddad25ec

    • SHA512

      68e23a47a5700dd84ab6b602842d723056cc26db12a7d70336da4c5ee0372cd95883da7232a2527fea21669f82fc1a44afb647b6bf25084dd78174e25ed724f0

    • SSDEEP

      6144:2tdYnKgBzqqrTzWBzqqrUzQ7M1L1MyzpmeJ4O:26O

    Score
    1/10
    behavioral21behavioral22

    • Target

      x64/plugins/MahApps.Metro.IconPacks.Coolicons.dll

    • Size

      451KB

    • MD5

      14f3f599e7a67c95d779820dba5a9fff

    • SHA1

      b88ea6caa09ecf11d2e6dbae039ab0734a823345

    • SHA256

      213956439f1d224be2f78ae9a345e2c02902750cd83a4a0439234afe801e75e5

    • SHA512

      e295ab8f8d90208f6a41320868d73a225a12bedc15591f2a19103a659fb437016ebded0c8fd62c61db3a8dadaafb07565cb76a51fd4113acd20cd568e36807a2

    • SSDEEP

      6144:Psu6HHHYtONor0Gw90Lx5FkbrawYhhGqlQz08aWFe/HD6TYm5oE3e3FsPgiu9g3z:P1774BfdWECoBmW

    Score
    1/10
    behavioral23behavioral24

    • Target

      x64/plugins/MahApps.Metro.IconPacks.Core.dll

    • Size

      19KB

    • MD5

      b705c478c096ef8ea4fc0738d52d1c84

    • SHA1

      44ec80a1259df99ac06cc342b03ca0fb9db22faf

    • SHA256

      b6156814d7014a38587991b19eec9228439bc0b2558cfa9bedb4e72ac611fccb

    • SHA512

      f212cde6c87920b3ee6e588c473987646c3f6ddca4b2122dd876ff61815dc7dccbbcb469024fd50cb0f3e1829643859e3eec4c8a91442056624c6f5922344b35

    • SSDEEP

      384:feCnIM4AZxFYzXKZHqwAodV5rroIYJFzcQ8tFq3qs6jUasojg4APsTTlj5a6wIYU:feu4RIDfov4bFyUjUnWsKGVD6

    Score
    1/10
    behavioral25behavioral26

    • Target

      x64/plugins/MahApps.Metro.IconPacks.Entypo.dll

    • Size

      490KB

    • MD5

      60aaa132d1992d132f7fbaef8cd0ccb3

    • SHA1

      6f7d9226d195efed993cae4a2ea447e125ce1d23

    • SHA256

      1017345eeae7e6df2b894c36ebad15f469474ca612749c9e1865126175c74364

    • SHA512

      1e82f82144674cf5591a1ead06f8d37b5dad11f16114c70664cd2891f6b32ef23ae543e34320105407e57d48543faa2286a8d8ff21dfa7076be3c18808d3a3ea

    • SSDEEP

      6144:5bworP4b71rPwhET9FDsBGZfiqJMUlOv5CuwVpKex7byEZAzftaDi/KAFwrSmfLM:9wKRLLKACX2m

    Score
    1/10
    behavioral27behavioral28

    • Target

      x64/plugins/MahApps.Metro.IconPacks.EvaIcons.dll

    • Size

      416KB

    • MD5

      721f37645c32653200b06969419344b2

    • SHA1

      ba5a3868632e98adef61c7a2999e726881eca4a7

    • SHA256

      14d31cdf80fab1df0f874e4f8d8090b5393b6ffac6cd86dfb5c71dd8f62f4e93

    • SHA512

      f3d8375d2df69fce7e4dbff68295281a94cdce9de86ef52aa951c7d2ff8cad48777a76192d6a20f0b804b307d48914f66fcff7bc25da2ab946de456079db59db

    • SSDEEP

      3072:esRQOZCZi9zOr8G2OIC5kXgRXgFmrUjwD:/RQwLbmW+

    Score
    1/10
    behavioral29behavioral30

    • Target

      x64/plugins/MahApps.Metro.IconPacks.FeatherIcons.dll

    • Size

      106KB

    • MD5

      0cb966a395147c28dd9abf5482ae64fc

    • SHA1

      81a657e20670a8cb120270047cae1f552ba40100

    • SHA256

      fa81d23b3ebf44d72897d673dfd750ae764de32d8d05888e77d80018e041156b

    • SHA512

      e58f13389f8e229ad44625320948f8fe1cbf469980c8774c1f8ecd4228edd8039af3e361ccec91ae011460801169eb85e8aa1eebe2be2282cb8b6d7944c36f2f

    • SSDEEP

      3072:7QVRLunLLLaDLQv4xLi/CLU9d+AHXkusnqyKM/6dNzj23T2rB6ibsKwGv6mBhZQ:AikuVdNzj23Vmbe

    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

vidar8f9b46cf1d8abd40fa96d1b9e9e32173stealer
Score
10/10

behavioral2

vidar8f9b46cf1d8abd40fa96d1b9e9e32173stealer
Score
10/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
3/10

behavioral6

Score
3/10

behavioral7

Score
1/10

behavioral8

Score
3/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
3/10

behavioral12

Score
3/10

behavioral13

Score
1/10

behavioral14

Score
3/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10