Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11/10/2024, 16:51
General
-
Target
yerfil.exe
-
Size
326KB
-
MD5
052ee1b1f87f8432c8f8bd6635bc3aaf
-
SHA1
9e44e03b1d8f1ad1c310f26cb04015c287c6875e
-
SHA256
c6bff8e3a8f9c83459a11e865977b45762ff860215678bd7ee228a07e3dd693a
-
SHA512
df471a95053d559cd543dc25af023ea00b832947afdbd8d94f65215866c135df5b05d0ad6d94e8d0e78f388ba29083b88116539885e27e546fb618a90fc9ed4f
-
SSDEEP
6144:OxEO9Kj+dDOA9E1UR31+CWmijUuUQWhWmgul5yuZRLRDTaYZdT0PNo0mTl:Ox59zDOwjV1+CWmiHUQWhWmD/yuZRlDz
Malware Config
Extracted
vidar
4
199bcf3c3505962e0da6b56ea1b4ccc2
https://steamcommunity.com/profiles/76561199508624021
https://t.me/looking_glassbot
-
profile_id_v2
199bcf3c3505962e0da6b56ea1b4ccc2
-
user_agent
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
Signatures
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\yerfil.exe"C:\Users\Admin\AppData\Local\Temp\yerfil.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
356KB
-
Filesize
436KB
-
Filesize
1024KB
-
Filesize
356KB
-
Filesize
436KB
-
Filesize
2.8MB
-
Filesize
2.8MB