Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe

  • Size

    4.3MB

  • Sample

    240419-qy6ldsdg72

  • MD5

    6d59b75f2b8bf7590c144cd4b3d24516

  • SHA1

    6325d9ea89692248cf599493743f637b7fefe726

  • SHA256

    50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0

  • SHA512

    77f29661bee56bd26e11abd359b1e01e23d76994cab99528242bd08b77c3c8be810b07855f76ef6394ae5a43b907cccb421fc525870b03f4afc1c7664607931a

  • SSDEEP

    49152:fc6PM2ku7KoRtVYIN9uCftMVtWf+NSzuHI791x4Ayjxw2PjCSK6Q70zPbyg8L3bn:fc6p37V9Bfa3Wf+N3I7Xx43byg8ua

Score
10/10

Malware Config

Extracted

Family

vidar

C2

https://steamcommunity.com/profiles/76561199673019888

https://t.me/irfail

Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0

Targets

    • Target

      50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0.exe

    • Size

      4.3MB

    • MD5

      6d59b75f2b8bf7590c144cd4b3d24516

    • SHA1

      6325d9ea89692248cf599493743f637b7fefe726

    • SHA256

      50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0

    • SHA512

      77f29661bee56bd26e11abd359b1e01e23d76994cab99528242bd08b77c3c8be810b07855f76ef6394ae5a43b907cccb421fc525870b03f4afc1c7664607931a

    • SSDEEP

      49152:fc6PM2ku7KoRtVYIN9uCftMVtWf+NSzuHI791x4Ayjxw2PjCSK6Q70zPbyg8L3bn:fc6p37V9Bfa3Wf+N3I7Xx43byg8ua

    Score
    10/10
    • Detect Vidar Stealer

    • Detect ZGRat V1

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks