Overview

overview

10

Static

static

10

2552-97-0x...ry.exe

windows7-x64

10

2552-97-0x...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2552-97-0x0000000000400000-0x000000000043D000-memory.dmp

  • Size

    244KB

  • MD5

    0f1021d59de0fe7bbe0c5a442998a565

  • SHA1

    ba32abd5e0abf7921f5f54a540baad279e00e30e

  • SHA256

    179d40961e7e79b729b4c857dd4d6b0537b4e6afd88a6c125c52abca9168ca0f

  • SHA512

    7d6116958fe8fe9f58236386dec3f92c474742244139d211a888892753dafa644ede45619856d797ac4e586e9155e0189af286142b926f2577f65db9736fb71f

  • SSDEEP

    3072:Um/E8k9ZjpIn+zNch12KbAwSaSVJSp8L+b8EG:N/E8k91rz6/tsK8EG

Score
10/10
defaultmarsstealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

C2

www.criminalaffair.com/wp-admin/admin-ajax.php

Signatures

  • Marsstealer family
    marsstealer
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2552-97-0x0000000000400000-0x000000000043D000-memory.dmp
    .exe windows x86


    Headers

    Sections