marsstealer | d1094bd38c1ea44442a040638da874d6ee15d6147ddaa5ada67f3598de545f02

General

Target

MegaTeam.exe
Size

30KB
Sample

221118-n9gqasdb9x
MD5

867eb3366690a2cd20ea3386c0ce8e82
SHA1

54b7e8f0d345e9907e309841490ca4d76807521b
SHA256

d1094bd38c1ea44442a040638da874d6ee15d6147ddaa5ada67f3598de545f02
SHA512

f98d01c6a13e9c833402178d0ac7f395fb6ee797ab8aa07b375cea5b31e709b083b092d232280878a3f0f90267726d788f23d525c6074143c75253a3622ac539
SSDEEP

384:p3O8DHK61imwJpt6CMwBEdE3b9kAI9X+E+eJlLpTvFBcw3eDG8EYjjrU4du:vHKMimkXMYQ/H+E/TLpwEeDGLYjj

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

1877

C2

overthinker1877.duckdns.org:60732

Extracted

Family

quasar

Version

2.7.0.0

Botnet

1877

C2

overthinker1877.duckdns.org:4545

Mutex

xiBqon3YI4gHicsPTt

Attributes

encryption_key
IshCdNN3oYnjATmMydkq
install_name
1877.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Venom Client Startup

Extracted

Family

marsstealer

Botnet

Default

C2

mars1877.duckdns.org/gate.php

Targets

- Target
  
  MegaTeam.exe
- Size
  
  30KB
- MD5
  
  867eb3366690a2cd20ea3386c0ce8e82
- SHA1
  
  54b7e8f0d345e9907e309841490ca4d76807521b
- SHA256
  
  d1094bd38c1ea44442a040638da874d6ee15d6147ddaa5ada67f3598de545f02
- SHA512
  
  f98d01c6a13e9c833402178d0ac7f395fb6ee797ab8aa07b375cea5b31e709b083b092d232280878a3f0f90267726d788f23d525c6074143c75253a3622ac539
- SSDEEP
  
  384:p3O8DHK61imwJpt6CMwBEdE3b9kAI9X+E+eJlLpTvFBcw3eDG8EYjjrU4du:vHKMimkXMYQ/H+E/TLpwEeDGLYjj
Score

10^/10

marsstealer quasar redline 1877 default collection discovery evasion infostealer persistence spyware stealer trojan
- Mars Stealer
  An infostealer written in C++ based on other infostealers.
  stealer marsstealer
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1