Extracted

• • Target

    mars-wallet-64-1.01.12.0-8438.exe

  • Size

    397KB

  • MD5

    581d545c4a3d99f4fb5b92752610e950

  • SHA1

    66deede4f00f1a76cdcb9e52c9a42b371875be38

  • SHA256

    612580febe9bad2c60ab8ad8564a38680cf415581c542e5e6109e680dc5e9d15

  • SHA512

    ef036240c359453850fc5ec4bddeddff0cf7d8c5b43ded1ae620cd76de9c7fbc07533ec859236c554e97c7b2fbf286f6914630b6f36a89620139e6bee2bc5c35

  • SSDEEP

    6144:ytN60S22Iq0NKGr8QsPgwKh10UfY2TDRK13yOz4RXvSTmE:ytN+ONKM8GwA6GJTVC3yO5N

  Score

  10^/10

  colibrirhadamanthysbotcollectiondiscoveryloaderspywarestealer

  • Colibri Loader

    A loader sold as MaaS first seen in August 2021.

    loadercolibri

  • Detect rhadamanthys stealer shellcode

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2