Overview

overview

10

Static

static

10

2692-11-0x...ry.exe

windows7-x64

10

2692-11-0x...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2692-11-0x0000000000400000-0x000000000043D000-memory.dmp

  • Size

    244KB

  • MD5

    962e87f6b453420fbc7ea6445113f1a3

  • SHA1

    aa8c3199916757da05036904543dc2f3c29d04b9

  • SHA256

    f06da96343e62c249c2f357878cff68f9ca95346904b165adf2b5eb5710efcf2

  • SHA512

    ffc6a941d36338f543151b269819ac1e38b9582f992c150e6f668e2bdcb48d92f015cc8c7cf246c9cd46b2ca33247f2b3dead1a6d9164f82d504272602073e54

  • SSDEEP

    3072:Um/E8k9ZjpIL+zNch12KbAwSaSIJSp8nixb8EG:N/E8k91zz6/ts98EG

Score
10/10
defaultmarsstealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

C2

151.236.218.158/wp/blog.php

Signatures

  • Marsstealer family
    marsstealer
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2692-11-0x0000000000400000-0x000000000043D000-memory.dmp
    .exe windows:5 windows x86


    Headers

    Sections