Overview

overview

10

Static

static

3

Ghost Hunt...G1.exe

windows7-x64

7

Ghost Hunt...G1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Ghost Hunter Vena_d-34UG1.exe

  • Size

    10.5MB

  • Sample

    231221-cwajaafchr

  • MD5

    7c3cdfd4ec2ef7074aa6cba65aedec95

  • SHA1

    b248fdaf6f4bdcb0c470059065069c931c9b6362

  • SHA256

    6dea57ecfe1a092b1c434f571276426140f18b514b79128f8daee7d61cd85c63

  • SHA512

    c40ba8d6663ea6a3e9125d8bcdb2cae8fc34cfc9d6b70746769d7c0921176f21a881f85a91f6f6280f7ddacd654d7ae394de01718a8210968ed8cafe2f82de52

  • SSDEEP

    12288:fuI/t26BoC4OIrOdSj5KFbkj2jUUDJLLUp+ezD3iH:TuOdSf2IKRU

Score
10/10
marsstealerdefaultspywarestealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

C2

moscow-post.ru/blogggg/blogger.php

Targets

    • Target

      Ghost Hunter Vena_d-34UG1.exe

    • Size

      10.5MB

    • MD5

      7c3cdfd4ec2ef7074aa6cba65aedec95

    • SHA1

      b248fdaf6f4bdcb0c470059065069c931c9b6362

    • SHA256

      6dea57ecfe1a092b1c434f571276426140f18b514b79128f8daee7d61cd85c63

    • SHA512

      c40ba8d6663ea6a3e9125d8bcdb2cae8fc34cfc9d6b70746769d7c0921176f21a881f85a91f6f6280f7ddacd654d7ae394de01718a8210968ed8cafe2f82de52

    • SSDEEP

      12288:fuI/t26BoC4OIrOdSj5KFbkj2jUUDJLLUp+ezD3iH:TuOdSf2IKRU

    Score
    10/10
    spywarestealermarsstealerdefault

    • Mars Stealer

      An infostealer written in C++ based on other infostealers.

      stealermarsstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks