Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    35c92bbeaf69c27f5a4fed4f9b52af72de47ccc66cb1494ff12d716a23da9969

  • Size

    155KB

  • Sample

    240417-qnsxjsah51

  • MD5

    2b23d7f0fdc0139d01f6122a4ee05d9b

  • SHA1

    9435fc51901865ba0e0c698b08a32dd2f00bd877

  • SHA256

    35c92bbeaf69c27f5a4fed4f9b52af72de47ccc66cb1494ff12d716a23da9969

  • SHA512

    59077d36ba3accbe60c4e0d3ce213a7b8eaf2d316047cbf4c367911101f90eab2357f7f6f45f581465a83d64b580824539bd26dcfa3c6058e3afd9319a0f14bf

  • SSDEEP

    3072:CQ9PMRIeJRgvwRxXDmao9gyJpWu+a0P3NDI66C7fZXcdHWe:CQ1mNJGGxozpWury9DD6C7ydHWe

Malware Config

Extracted

Family

vidar

Version

6.4

Botnet

f3872ed7b089c1810bdd0f3418ae791c

C2

https://t.me/secgoxrp

https://steamcommunity.com/profiles/76561199568528949

Attributes
  • profile_id_v2

    f3872ed7b089c1810bdd0f3418ae791c

  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:110.0) Gecko/20100101 Firefox/121.0

Targets

    • Target

      97a504256f3e7627c02025fe05e4330d9d8fdf222db845371238da6dc75ddca1.exe

    • Size

      268KB

    • MD5

      9cded6231bc11b77032dbf321a65a16b

    • SHA1

      a91fd07758ac2189920f62e3e6245ba2b91f091b

    • SHA256

      97a504256f3e7627c02025fe05e4330d9d8fdf222db845371238da6dc75ddca1

    • SHA512

      7ed2e6913c7c823971bcffe3275e7c436ede119320bdd4465a10ff5b15f81138feadb0cab9a64d743fd08ddf5441f78750d65a4c4a3d55cd576f1e5e82138116

    • SSDEEP

      3072:TTqs+j7RsNC8jHj4izDObQoZZKTcouI2g/6XzzzMXaWjFeIy9Oyx:Xaj7RQ1Hj//ObQoucou4/6XzrWFexM

    • Detect Vidar Stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks