Overview

overview

10

Static

static

10

1124-10-0x...ry.exe

windows7-x64

10

1124-10-0x...ry.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    1124-10-0x0000000000400000-0x000000000043D000-memory.dmp

  • Size

    244KB

  • MD5

    55f2fb226a08f15168638f9628cee819

  • SHA1

    e24c936a5546839b76eac7eaa7aadfd6ba3e09bf

  • SHA256

    7d07fc3ed41aebfce70f0379dddc93dc819a1375761696bb46a52941413e6ea5

  • SHA512

    fd14930adc3d53045e364fa6b1f5484cb7905c486d7e9c508961f01800a0e56148a7c11ab1410bf805df293bc3bf46c6922ec5118cc4a906a8ed47027d71fd51

  • SSDEEP

    3072:Um/E8k9ZjpIn+zNch12KbAwSaSbJSp8Bb8EG:N/E8k91rz6/t88EG

Score
10/10
defaultmarsstealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

C2

91.92.250.149/gate.php

Signatures

  • Marsstealer family
    marsstealer
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1124-10-0x0000000000400000-0x000000000043D000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections