Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    https://www.youtube.com/redirect?event=channel_description&redir_token=QUFFLUhqbDlwT0ZwMlp4QnotOHRmZ1M4VzBQSVE1dnBBd3xBQ3Jtc0trNlNUVUFpcnNFZUloaWdXU0FwRjB6bFh0M3plVm9zWGpZbnV6V2trQlpNYXBVMUxTSE9Pb3QyWGdubERldTB5WU9VdTJCN2ZNTzNNVERtTHNzejVCVmtYVVBsM2tBMGpyanM2QkZ4V29hdlpGZHJYZw&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Fv6itahr4p07b1%2FFiles

  • Sample

    241011-qc7xbsyepm

Malware Config

Extracted

Family

vidar

Version

11.1

Botnet

467d1313a0fbcd97b65a6f1d261c288f

C2

https://steamcommunity.com/profiles/76561199786602107

https://t.me/lpnjoke

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Targets

    • Target

      https://www.youtube.com/redirect?event=channel_description&redir_token=QUFFLUhqbDlwT0ZwMlp4QnotOHRmZ1M4VzBQSVE1dnBBd3xBQ3Jtc0trNlNUVUFpcnNFZUloaWdXU0FwRjB6bFh0M3plVm9zWGpZbnV6V2trQlpNYXBVMUxTSE9Pb3QyWGdubERldTB5WU9VdTJCN2ZNTzNNVERtTHNzejVCVmtYVVBsM2tBMGpyanM2QkZ4V29hdlpGZHJYZw&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Fv6itahr4p07b1%2FFiles

    • Detect Vidar Stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Creates new service(s)

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Stops running service(s)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Legitimate hosting services abused for malware hosting/C2

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks