Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

yerfil.exe

windows10-2004-x64

10

yerfil.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    yerfil.exe

  • Size

    326KB

  • Sample

    241011-vc4bcsxgml

  • MD5

    052ee1b1f87f8432c8f8bd6635bc3aaf

  • SHA1

    9e44e03b1d8f1ad1c310f26cb04015c287c6875e

  • SHA256

    c6bff8e3a8f9c83459a11e865977b45762ff860215678bd7ee228a07e3dd693a

  • SHA512

    df471a95053d559cd543dc25af023ea00b832947afdbd8d94f65215866c135df5b05d0ad6d94e8d0e78f388ba29083b88116539885e27e546fb618a90fc9ed4f

  • SSDEEP

    6144:OxEO9Kj+dDOA9E1UR31+CWmijUuUQWhWmgul5yuZRLRDTaYZdT0PNo0mTl:Ox59zDOwjV1+CWmiHUQWhWmD/yuZRlDz

Score
10/10
vidar199bcf3c3505962e0da6b56ea1b4ccc2discoverystealer

Malware Config

Extracted

Family

vidar

Version

4

Botnet

199bcf3c3505962e0da6b56ea1b4ccc2

C2

https://steamcommunity.com/profiles/76561199508624021

https://t.me/looking_glassbot
Attributes
  • profile_id_v2

    199bcf3c3505962e0da6b56ea1b4ccc2

  • user_agent

    Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36

Targets

    • Target

      yerfil.exe

    • Size

      326KB

    • MD5

      052ee1b1f87f8432c8f8bd6635bc3aaf

    • SHA1

      9e44e03b1d8f1ad1c310f26cb04015c287c6875e

    • SHA256

      c6bff8e3a8f9c83459a11e865977b45762ff860215678bd7ee228a07e3dd693a

    • SHA512

      df471a95053d559cd543dc25af023ea00b832947afdbd8d94f65215866c135df5b05d0ad6d94e8d0e78f388ba29083b88116539885e27e546fb618a90fc9ed4f

    • SSDEEP

      6144:OxEO9Kj+dDOA9E1UR31+CWmijUuUQWhWmgul5yuZRLRDTaYZdT0PNo0mTl:Ox59zDOwjV1+CWmiHUQWhWmD/yuZRlDz

    Score
    10/10
    vidar199bcf3c3505962e0da6b56ea1b4ccc2discoverystealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks