Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    f3d744b6b3c378518e95dc021ee00151b2d380e7360e3b4521e5b52e55757740

  • Size

    211KB

  • Sample

    240417-p71wtsgc49

  • MD5

    a2f2b1722346910d72cb4fc0e8fd6267

  • SHA1

    1554606969fe5847c5e038981a05adea008ae04f

  • SHA256

    f3d744b6b3c378518e95dc021ee00151b2d380e7360e3b4521e5b52e55757740

  • SHA512

    2a728a18a0ae814e25fd1acc4ed08a3aa68667f1e22529af776f04a237178552cc8242bae9b839c04e9c77b34120c695ef26dbd69fdc18cd1c9711362cd507d3

  • SSDEEP

    6144:/LabpyNkMoaksPC2ipJvrZjT+LIeyRclihlc:ub0kM3OlblP7bcli8

Malware Config

Extracted

Family

vidar

Version

8.6

Botnet

debff3f4f38e9beeaf8e215a762c8549

C2

https://steamcommunity.com/profiles/76561199658817715

https://t.me/sa9ok

Attributes
  • profile_id_v2

    debff3f4f38e9beeaf8e215a762c8549

  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36

Targets

    • Target

      631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907.exe

    • Size

      224KB

    • MD5

      78f23006210bda6b5e26b8cbefa9758a

    • SHA1

      b1a191597f5a2ecdd3b9185b89072cfae06ae5cd

    • SHA256

      631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907

    • SHA512

      cf073cd4df9b13a9c79d9908952b88e9aef7c57c208031a6a758b2e3176841dfaa90206228af0c6a08c3b266b06fcd46d00ebde9c98906408affec9fbd9d0cc2

    • SSDEEP

      6144:No9+UOY1p3TTTFt/rIQuwkpAoVBIiNeXtd5yE:NEOAZtXtueXtdR

    • Detect Vidar Stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks