Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
51cba9b4aefefaf72a791e1929f98553f50d643a22179a6aaac9d13f45ea8b43
-
Size
355KB
-
Sample
240530-2wewfach5z
-
MD5
22152460b13e4c2473dc3fcdea192933
-
SHA1
48ce4a69302e860cd905cd02a10aac942f09d9f3
-
SHA256
51cba9b4aefefaf72a791e1929f98553f50d643a22179a6aaac9d13f45ea8b43
-
SHA512
1dbcc6f21c9adfc4f28434cffac8c00fb251e3fbf574a69345792837989f74bfc74a67462e7c4f71333a07caf90e0f3e6c51daf0b2640bae3e06af14c8855104
-
SSDEEP
6144:KnRqyzZ8VqCaMx3CkcY7FGCdGr0gx1POGIAYanWdHBSxz27XrvnksFwemJ:6RqyzZ2IOGCgfPOGI2nWdhSzUbkReG
Static task
static1
Behavioral task
behavioral1
Sample
51cba9b4aefefaf72a791e1929f98553f50d643a22179a6aaac9d13f45ea8b43.exe
Resource
win7-20231129-en
Malware Config
Extracted
stealc
Extracted
vidar
https://steamcommunity.com/profiles/76561199689717899
https://t.me/copterwin
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
Targets
-
-
Target
51cba9b4aefefaf72a791e1929f98553f50d643a22179a6aaac9d13f45ea8b43
-
Size
355KB
-
MD5
22152460b13e4c2473dc3fcdea192933
-
SHA1
48ce4a69302e860cd905cd02a10aac942f09d9f3
-
SHA256
51cba9b4aefefaf72a791e1929f98553f50d643a22179a6aaac9d13f45ea8b43
-
SHA512
1dbcc6f21c9adfc4f28434cffac8c00fb251e3fbf574a69345792837989f74bfc74a67462e7c4f71333a07caf90e0f3e6c51daf0b2640bae3e06af14c8855104
-
SSDEEP
6144:KnRqyzZ8VqCaMx3CkcY7FGCdGr0gx1POGIAYanWdHBSxz27XrvnksFwemJ:6RqyzZ2IOGCgfPOGI2nWdhSzUbkReG
-
Detect Vidar Stealer
-
Downloads MZ/PE file
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-