Overview

overview

10

Static

static

10

1328-1-0x0...ry.exe

windows7-x64

10

1328-1-0x0...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1328-1-0x0000000000400000-0x000000000043E000-memory.dmp

  • Size

    248KB

  • MD5

    8db96c7258f48a44d2ff4b0a8f0b19a9

  • SHA1

    2c45163f41e41ffa73d8a2fcf3545db72f68541d

  • SHA256

    331ae8d6782c25a0939f4c66d3e127c8008d44127b29ca2932274a17becd288a

  • SHA512

    7c9ea39a644a89f08ee52d1c4c3a3603a0652859a099de4fd85a6caaff9eb0ca753b1f27120e3db7fe3b9ef0914c153171ffcfd767cd0241412d3f8f18da939a

  • SSDEEP

    3072:3P/E8k9ZjpIL+zNch12KbAwSaSMJSp8Bhab8EG://E8k91zz6/t3hW8EG

Score
10/10
defaultmarsstealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

C2

www.criminalaffair.com/07516e72fc86fad83aead3ae7.php

Signatures

  • Marsstealer family
    marsstealer
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1328-1-0x0000000000400000-0x000000000043E000-memory.dmp
    .exe windows:5 windows x86


    Headers

    Sections