Overview

overview

10

Static

static

3

Ghost Hunt...G1.exe

windows7-x64

10

Ghost Hunt...G1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ShE8qQv970pdsiQkvoCPdggJI3RnzXRX

  • Size

    235KB

  • Sample

    231221-cr7cfsfchj

  • MD5

    f00006d42f06343a11d761e36f11937d

  • SHA1

    0d2e4832dbc7999badfb54dd860b97f32f311849

  • SHA256

    09854915bafa02b6de0ee7b94d2487e7c8867563c1194ee8cb73d7e0cbc60d97

  • SHA512

    ce9ac2f318583e4edf1731f0dad4fbce1964f2c8c52a578ade1e7ac63cb03b55960a782e2f40655457cc1c807427e918713380cd40b49247ad216658c87791ae

  • SSDEEP

    6144:lchb+Ro4mr3miBsYOAy/zO1JgymEp6rCbl22ACQLLdir:oIymYYzu+xCbigr

Score
10/10
marsstealerdefaultspywarestealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

C2

moscow-post.ru/blogggg/blogger.php

Targets

    • Target

      Ghost Hunter Vena_d-34UG1.exe

    • Size

      10.5MB

    • MD5

      7c3cdfd4ec2ef7074aa6cba65aedec95

    • SHA1

      b248fdaf6f4bdcb0c470059065069c931c9b6362

    • SHA256

      6dea57ecfe1a092b1c434f571276426140f18b514b79128f8daee7d61cd85c63

    • SHA512

      c40ba8d6663ea6a3e9125d8bcdb2cae8fc34cfc9d6b70746769d7c0921176f21a881f85a91f6f6280f7ddacd654d7ae394de01718a8210968ed8cafe2f82de52

    • SSDEEP

      12288:fuI/t26BoC4OIrOdSj5KFbkj2jUUDJLLUp+ezD3iH:TuOdSf2IKRU

    Score
    10/10
    marsstealerdefaultspywarestealer

    • Mars Stealer

      An infostealer written in C++ based on other infostealers.

      stealermarsstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks