Overview

overview

10

Static

static

10

8b526ff197...fe.exe

windows7-x64

10

8b526ff197...fe.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8b526ff1976f1ca1fde34987043d0dfe

  • Size

    5.7MB

  • Sample

    231219-yqc8waghgp

  • MD5

    8b526ff1976f1ca1fde34987043d0dfe

  • SHA1

    4148e8e132ea93c468f3cbe0bfd22e634534429e

  • SHA256

    f456a8901ab04ed11142a4f5413cbba1f13778a319b0c9d4815cb4f5e542c56c

  • SHA512

    17467935b180b02fd208f6e6b6a4501e8ef068ba585a498e72cbbcf17a930303105c561cfb1b865c018e106656e03a89004dcf62283536f2dbf8863461b972f0

  • SSDEEP

    98304:AWRoEv+kq6JTWCyMOAqy0x1N4gPSBdBND3SzVnNTEPg+i+0H2auhP3dmt93bRs:X0kbFoy0xfxPadBN7agg80HZuh0ba

Score
10/10
marsstealerspywarestealervmprotect

Malware Config

Extracted

Family

marsstealer

C2

sadasew94okl234.000webhostapp.com/d1c107a865581ff88ad673786ee059f2.php

Targets

    • Target

      8b526ff1976f1ca1fde34987043d0dfe

    • Size

      5.7MB

    • MD5

      8b526ff1976f1ca1fde34987043d0dfe

    • SHA1

      4148e8e132ea93c468f3cbe0bfd22e634534429e

    • SHA256

      f456a8901ab04ed11142a4f5413cbba1f13778a319b0c9d4815cb4f5e542c56c

    • SHA512

      17467935b180b02fd208f6e6b6a4501e8ef068ba585a498e72cbbcf17a930303105c561cfb1b865c018e106656e03a89004dcf62283536f2dbf8863461b972f0

    • SSDEEP

      98304:AWRoEv+kq6JTWCyMOAqy0x1N4gPSBdBND3SzVnNTEPg+i+0H2auhP3dmt93bRs:X0kbFoy0xfxPadBN7agg80HZuh0ba

    Score
    10/10
    marsstealerspywarestealervmprotect

    • Mars Stealer

      An infostealer written in C++ based on other infostealers.

      stealermarsstealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks