marsstealer | daf0e8f20ba17846c23d6e6006ab07cfd8f0b78d2914b26de1f87f9b60b4859b | Triage

Sharing

General

Target

424d62f26707eace0cd7a2f75f07b636
Size

93KB
Sample

231219-rrve8aeddj
MD5

424d62f26707eace0cd7a2f75f07b636
SHA1

c920b3d3b89bb5195059765cc63da80da7edd826
SHA256

daf0e8f20ba17846c23d6e6006ab07cfd8f0b78d2914b26de1f87f9b60b4859b
SHA512

fbd0ca98e3699bcbf18381cc91cd4e8aca59cfd1168ddadf10a3b5c6568c95dec7d6ff7e326f37f7b1325a6cd5e36e9d4c1741cffbf9e0f8af53b9ef00bdb8ea
SSDEEP

1536:oWTHVn5wa8TXvqHp6kzWgDaO3C54Gf3lagvHkMTafiyVDr1lVUj3jy0:oWTHVn8TXvc4O3CFvlaSED1Pqj/

Score

10^/10

marsstealer spyware stealer

Malware Config

Extracted

Family

marsstealer

C2

sadasew94okl234.000webhostapp.com/gate.php

Targets

- Target
  
  424d62f26707eace0cd7a2f75f07b636
- Size
  
  93KB
- MD5
  
  424d62f26707eace0cd7a2f75f07b636
- SHA1
  
  c920b3d3b89bb5195059765cc63da80da7edd826
- SHA256
  
  daf0e8f20ba17846c23d6e6006ab07cfd8f0b78d2914b26de1f87f9b60b4859b
- SHA512
  
  fbd0ca98e3699bcbf18381cc91cd4e8aca59cfd1168ddadf10a3b5c6568c95dec7d6ff7e326f37f7b1325a6cd5e36e9d4c1741cffbf9e0f8af53b9ef00bdb8ea
- SSDEEP
  
  1536:oWTHVn5wa8TXvqHp6kzWgDaO3C54Gf3lagvHkMTafiyVDr1lVUj3jy0:oWTHVn8TXvc4O3CFvlaSED1Pqj/
Score

7^/10

spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2