Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c18daf8d23214417f5c2165c850ffe0e83b657d9ba045dde50757cfd5b5f4dbc

  • Size

    3.3MB

  • Sample

    240810-vhsf2sydqm

  • MD5

    3b0041dfa75c093509fd3e2e1a144532

  • SHA1

    a294857985afb4a0e6ec3f2d5cb07cf2298ba94f

  • SHA256

    c18daf8d23214417f5c2165c850ffe0e83b657d9ba045dde50757cfd5b5f4dbc

  • SHA512

    f04a084d16d3ed056537d514edb7ebb81aa96aca384b35b12ca6fb1847a1cc205a24be5c9606d3043ddb1aa691d9e187df1a4e709a315283ea2d8437c7e87b66

  • SSDEEP

    49152:YQdYX/DGwoPPzLEfh+OuZA2lyfbSbU4SymzeSgfxMFB:YQW/JqzIND2lyf7hymzeSgqT

Score
10/10
vidarcredential_accessdiscoverystealer

Malware Config

Extracted

Family

vidar

C2

https://steamcommunity.com/profiles/76561199751190313

https://t.me/pech0nk
Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Targets

    • Target

      c18daf8d23214417f5c2165c850ffe0e83b657d9ba045dde50757cfd5b5f4dbc

    • Size

      3.3MB

    • MD5

      3b0041dfa75c093509fd3e2e1a144532

    • SHA1

      a294857985afb4a0e6ec3f2d5cb07cf2298ba94f

    • SHA256

      c18daf8d23214417f5c2165c850ffe0e83b657d9ba045dde50757cfd5b5f4dbc

    • SHA512

      f04a084d16d3ed056537d514edb7ebb81aa96aca384b35b12ca6fb1847a1cc205a24be5c9606d3043ddb1aa691d9e187df1a4e709a315283ea2d8437c7e87b66

    • SSDEEP

      49152:YQdYX/DGwoPPzLEfh+OuZA2lyfbSbU4SymzeSgfxMFB:YQW/JqzIND2lyf7hymzeSgqT

    Score
    10/10
    vidarcredential_accessdiscoverystealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Downloads MZ/PE file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks