Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqa2VVRHhrcVFGWW1zRVJYMTdtVld0Y0s1SWVRQXxBQ3Jtc0tsUUJKVFZlVXZRZGZEdDFISDc1ZkluY0s0a3BWYzdHa1hMYnk1eWt0Zm8tdklLV25DcUpVbTZEQXplZTljNHlWdHd1QlNpdDlPeFdPY19zUTdVT1JQaEhBa2Z2Rmlac1M2cVVNaVZUa3FPSC1jQVp2NA&q=https%3A%2F%2Ftinyurl.com%2FPureSoftware
-
Sample
250328-lmcfystzh1
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqa2VVRHhrcVFGWW1zRVJYMTdtVld0Y0s1SWVRQXxBQ3Jtc0tsUUJKVFZlVXZRZGZEdDFISDc1ZkluY0s0a3BWYzdHa1hMYnk1eWt0Zm8tdklLV25DcUpVbTZEQXplZTljNHlWdHd1QlNpdDlPeFdPY19zUTdVT1JQaEhBa2Z2Rmlac1M2cVVNaVZUa3FPSC1jQVp2NA&q=https%3A%2F%2Ftinyurl.com%2FPureSoftware
Resource
win11-20250314-en
Malware Config
Extracted
vidar
13.3
bfe115f7387221a40d0ed4062bb79147
https://t.me/lw25chm
https://steamcommunity.com/profiles/76561199839170361
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0
Targets
-
-
Target
https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqa2VVRHhrcVFGWW1zRVJYMTdtVld0Y0s1SWVRQXxBQ3Jtc0tsUUJKVFZlVXZRZGZEdDFISDc1ZkluY0s0a3BWYzdHa1hMYnk1eWt0Zm8tdklLV25DcUpVbTZEQXplZTljNHlWdHd1QlNpdDlPeFdPY19zUTdVT1JQaEhBa2Z2Rmlac1M2cVVNaVZUa3FPSC1jQVp2NA&q=https%3A%2F%2Ftinyurl.com%2FPureSoftware
-
Detect Vidar Stealer
-
Vidar family
-
Uses browser remote debugging
Can be used control the browser and steal sensitive information such as credentials and session cookies.
-
Suspicious use of SetThreadContext
-