General

  • Target

    2988-1-0x0000000000400000-0x000000000043D000-memory.dmp

  • Size

    244KB

  • MD5

    2181054970b1e0c0bfbb89b99fab9a9d

  • SHA1

    ef7f71462ad8a449dd45bbf66778baff0546a3df

  • SHA256

    05a2209caa10d5fa33d278110d3ec4f701f7123422afa38fa03fac6d84937c6f

  • SHA512

    66943fcc0e43889705d6f46ea7725be8d73e299a742773c4911306c7772f52336b9a60a11958b84d95572fa825135385fb470fea3431154be4ccdbaae69793d6

  • SSDEEP

    3072:Um/E8k9ZjpIL+zNch12KbAwSaS7JSp81vb8EG:N/E8k91zz6/t0D8EG

Score
10/10

Malware Config

Extracted

Family

marsstealer

Botnet

Default

C2

dispatchweekly.com/wp.php

Signatures

  • Marsstealer family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2988-1-0x0000000000400000-0x000000000043D000-memory.dmp
    .exe windows x86


    Headers

    Sections