Extracted

• • Target

    Parcel [email protected]

  • Size

    141KB

  • MD5

    a5db6adb574552a24d3b886762f4dbf3

  • SHA1

    caf958dad191f647eb6d4ef885cf4da92e11969e

  • SHA256

    f58a5c7c34a09860c8aaf590ce7cd9de51267edf6b3153f575a7caf6d8832364

  • SHA512

    bf1bc5bf939e9e792720fe8b2fabc9adacb75c49d80b6cdb5dc7a44a50043a7304ac44b19c7f227dae2ee8c6d02cb3a431841c816c03678a1462533a69f0953c

  • SSDEEP

    1536:yo5pvN49Hq+qqqXlllllllll6vURCmo3NGqPqOxrFt1WbKQrxqkqfbL:fpav33lRB6ybL

  Score

  10^/10

  marsstealerdefaultpersistencespywarestealer

  • Mars Stealer

    An infostealer written in C++ based on other infostealers.

    stealermarsstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2