Overview

overview

10

Static

static

3

09766b3da2...d0.exe

windows7-x64

10

09766b3da2...d0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f5340a79f33a55311010574d013bb17c.bin

  • Size

    123KB

  • Sample

    231222-cp9psshfe6

  • MD5

    2cf8803dde7534c4155d71eafe10e310

  • SHA1

    3abbb46c5e2eddaf8bf0c7ef37d1ac2a2d60205a

  • SHA256

    338d2d8e472b2a2bc2fb7d250f7884ef43337ed0a1c3b700654a32eca1c28304

  • SHA512

    dd0bf165a2adae9e6b280e7fad63f9107f83fa4372feb67cd581279ed47d2616c3ceaa679e87353891023466cef98e6b98ab1986c52e606038eaaaa3e1cc7dd0

  • SSDEEP

    3072:Y/k0a8PEiUs9MDbyZ43ARIcla91Dqzu5Rf6Hk4ChmBPAg:Yta8ciUs9Me430IXDQKinsmhAg

Score
10/10
marsstealerdefaultspywarestealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

C2

www.msk-post.com/server/string.php

Targets

    • Target

      09766b3da2146a553aba42fbaad1694e2e4996dd6d488c2e32bf85429d4852d0.exe

    • Size

      13.4MB

    • MD5

      f5340a79f33a55311010574d013bb17c

    • SHA1

      1552381ccf239d85c1431509713784dc420aa674

    • SHA256

      09766b3da2146a553aba42fbaad1694e2e4996dd6d488c2e32bf85429d4852d0

    • SHA512

      42f3a21ab1679c534900660acf17c49bc9ce7f9cffb37b259a1d580980a7de03d0177d453c163159695a19e9a0f71f8f0fe6ec26105618bb61b0bef2ce286fd8

    • SSDEEP

      3072:3GPqxRvWpV2rSEBLCjiV7ltx/qV/1nBIrsr+T1fAJmZkVTJbtZOyJSp8Bb8EGRf:G+JOIhiulXqV9idqo6TBf8EGh

    Score
    10/10
    marsstealerdefaultspywarestealer

    • Mars Stealer

      An infostealer written in C++ based on other infostealers.

      stealermarsstealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks