marsstealer | 846f5e52aa6b4f11a29cab1f505463938938c3c5ad8d753fe70a148200c8c446 | Triage

Resubmissions

21-12-2023 18:53

231221-xjlq1abehm 10

Sharing

General

Target

OperaGXSetup.exe
Size

11.5MB
Sample

231221-xjlq1abehm
MD5

46431992aa566007949fc4acbc058856
SHA1

533e0cef48e51095f1460fd52cc542923d23d29d
SHA256

846f5e52aa6b4f11a29cab1f505463938938c3c5ad8d753fe70a148200c8c446
SHA512

02b1bb111b9db1af37d7f06a36e5f59aac0e9f6a36878db0148f36b7c68ac93f0d136755a8b0a084a510adf2b9eff4cd72b2ab20849a0ea333920557808a2a52
SSDEEP

3072:3+fKfLxPq+l/AGDF+FUN9TgPC543HaHJSp8Bb8EGF9N7:OfKfI+l4GDCACS4Kz8EGF9N

Score

10^/10

marsstealer default spyware stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

C2

www.msk-post.com/server/init.php

Targets

- Target
  
  OperaGXSetup.exe
- Size
  
  11.5MB
- MD5
  
  46431992aa566007949fc4acbc058856
- SHA1
  
  533e0cef48e51095f1460fd52cc542923d23d29d
- SHA256
  
  846f5e52aa6b4f11a29cab1f505463938938c3c5ad8d753fe70a148200c8c446
- SHA512
  
  02b1bb111b9db1af37d7f06a36e5f59aac0e9f6a36878db0148f36b7c68ac93f0d136755a8b0a084a510adf2b9eff4cd72b2ab20849a0ea333920557808a2a52
- SSDEEP
  
  3072:3+fKfLxPq+l/AGDF+FUN9TgPC543HaHJSp8Bb8EGF9N7:OfKfI+l4GDCACS4Kz8EGF9N
Score

10^/10

spyware stealer marsstealer default
- Mars Stealer
  An infostealer written in C++ based on other infostealers.
  stealer marsstealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

Install Root Certificate

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2

marsstealerdefaultspywarestealer