Extracted

• • Target
    mars-wallet-64-1.01.12.0-8438.exe
  • Size 397KB
  • SHA256 612580febe9bad2c60ab8ad8564a38680cf415581c542e5e6109e680dc5e9d15
  • MD5 581d545c4a3d99f4fb5b92752610e950
  • SHA1 66deede4f00f1a76cdcb9e52c9a42b371875be38
  • SHA512 ef036240c359453850fc5ec4bddeddff0cf7d8c5b43ded1ae620cd76de9c7fbc07533ec859236c554e97c7b2fbf286f6914630b6f36a89620139e6bee2bc5c35
  • SSDEEP 6144:ytN60S22Iq0NKGr8QsPgwKh10UfY2TDRK13yOz4RXvSTmE:ytN+ONKM8GwA6GJTVC3yO5N
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  colibrirhadamanthysbotcollectiondiscoveryloaderspywarestealer

  • Colibri Loader

    A loader sold as MaaS first seen in August 2021.

    loadercolibri

  • Detect rhadamanthys stealer shellcode

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2