Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqa2VVRHhrcVFGWW1zRVJYMTdtVld0Y0s1SWVRQXxBQ3Jtc0tsUUJKVFZlVXZRZGZEdDFISDc1ZkluY0s0a3BWYzdHa1hMYnk1eWt0Zm8tdklLV25DcUpVbTZEQXplZTljNHlWdHd1QlNpdDlPeFdPY19zUTdVT1JQaEhBa2Z2Rmlac1M2cVVNaVZUa3FPSC1jQVp2NA&q=https%3A%2F%2Ftinyurl.com%2FPureSoftware

  • Sample

    250328-lmcfystzh1

Malware Config

Extracted

Family

vidar

Version

13.3

Botnet

bfe115f7387221a40d0ed4062bb79147

C2

https://t.me/lw25chm

https://steamcommunity.com/profiles/76561199839170361

Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Targets

    • Target

      https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqa2VVRHhrcVFGWW1zRVJYMTdtVld0Y0s1SWVRQXxBQ3Jtc0tsUUJKVFZlVXZRZGZEdDFISDc1ZkluY0s0a3BWYzdHa1hMYnk1eWt0Zm8tdklLV25DcUpVbTZEQXplZTljNHlWdHd1QlNpdDlPeFdPY19zUTdVT1JQaEhBa2Z2Rmlac1M2cVVNaVZUa3FPSC1jQVp2NA&q=https%3A%2F%2Ftinyurl.com%2FPureSoftware

    • Detect Vidar Stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar family

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks