Static task
static1
Behavioral task
behavioral1
Sample
MarsBar 1.0/MarsBar 1.0.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
MarsBar 1.0/MarsBar 1.0.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
MarsBar 1.0/Перекинуть сюда MARSBAR.lnk
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
MarsBar 1.0/Перекинуть сюда MARSBAR.lnk
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
xenos64.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
xenos64.exe
Resource
win10v2004-20231215-en
General
-
Target
713fdb76699138c76642f7d5895179ca
-
Size
617KB
-
MD5
713fdb76699138c76642f7d5895179ca
-
SHA1
b26771bbfb514631b637e4a7b71f3204789468c0
-
SHA256
0c07064de9cbb2d2957590cde1ed52261c1faa43e7af1c3c137729a3156796bb
-
SHA512
3edcfa9e3f2547b6e58a6415ddd1a1a741df0fb84878e605dfa307b91a0ce9925274de393dcc3d043d1f3de92936794b5f20e215fb89d864d0dc07d17eb965d5
-
SSDEEP
12288:7/h6cMGDZqo2FvteMZDVJmE8A2rtTHgFeW1VT73EHmfdBslw:7/UEwRtB9ms2GYCGmlma
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/MarsBar 1.0/MarsBar 1.0.dll
Files
-
713fdb76699138c76642f7d5895179ca.rar
-
MarsBar 1.0/MarsBar 1.0.dll.dll windows:6 windows x64 arch:x64
f5c1f4363a38cd426c9221cc0a58e068
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
HeapFree
InitializeCriticalSectionEx
GetLastError
HeapReAlloc
CreateThread
HeapAlloc
HeapDestroy
DeleteCriticalSection
GetTickCount
GetModuleHandleA
ConvertThreadToFiber
SwitchToFiber
CreateFiber
VirtualQuery
Sleep
FreeLibraryAndExitThread
GetModuleFileNameA
OutputDebugStringA
ExitProcess
GetModuleHandleW
QueryPerformanceCounter
HeapCreate
VirtualProtect
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
CloseHandle
GetThreadContext
GetProcAddress
GetCurrentProcessId
FlushInstructionCache
SetThreadContext
OpenThread
VirtualFree
VirtualAlloc
GetSystemInfo
InitializeSListHead
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
OutputDebugStringW
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
user32
MessageBoxA
GetAsyncKeyState
CallWindowProcW
SetWindowLongPtrW
FindWindowW
winmm
timeGetTime
msvcp140
?_BADOFF@std@@3_JB
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Xbad_function_call@std@@YAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
vcruntime140
memcpy
__std_type_info_destroy_list
__std_exception_destroy
_CxxThrowException
__std_exception_copy
__CxxFrameHandler3
_purecall
memmove
__vcrt_InitializeCriticalSectionEx
__C_specific_handler
__std_terminate
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_execute_onexit_table
exit
_invalid_parameter_noinfo_noreturn
terminate
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_crt_atexit
_configure_narrow_argv
_seh_filter_dll
_initterm
_cexit
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
api-ms-win-crt-string-l1-1-0
strcat_s
_strdup
strcmp
strcpy_s
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf_s
__stdio_common_vsprintf
__stdio_common_vsnprintf_s
fopen_s
fclose
__stdio_common_vsprintf_s
api-ms-win-crt-time-l1-1-0
_localtime64_s
_time64
api-ms-win-crt-convert-l1-1-0
strtol
atof
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
round
cosf
sinf
roundf
api-ms-win-crt-utility-l1-1-0
srand
Sections
.text Size: 213KB - Virtual size: 212KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 133KB - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 100KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 60B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
MarsBar 1.0/Nano42.log
-
MarsBar 1.0/Перекинуть сюда MARSBAR.lnk.lnk
-
xenos64.exe.exe windows:6 windows x64 arch:x64
4a7ec7340da8cbdca5da87aee6d354fb
Code Sign
16:e9:b8:bb:70:0e:18:57:b2:b0:80:9d:3c:f1:51:35Certificate
IssuerCN=BlackBoneSPCNot Before12/09/2014, 10:21Not After31/12/2039, 23:59SubjectCN=BlackBoneSPC48:a8:c4:aa:ac:3e:e5:e3:a2:d4:e9:76:86:30:b4:49:15:ea:91:34Signer
Actual PE Digest48:a8:c4:aa:ac:3e:e5:e3:a2:d4:e9:76:86:30:b4:49:15:ea:91:34Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shlwapi
SHDeleteKeyW
SHSetValueW
dbghelp
MiniDumpWriteDump
kernel32
DeleteCriticalSection
CreateProcessW
GetCurrentProcess
GetModuleFileNameW
WaitForSingleObject
CreateFileW
GetCurrentThreadId
Sleep
CreateThread
GetLocalTime
ExitProcess
GetCurrentProcessId
SetUnhandledExceptionFilter
FlushFileBuffers
GetFileAttributesW
ResumeThread
SizeofResource
GetCommandLineW
WriteFile
LockResource
DeleteFileW
GetNativeSystemInfo
GetWindowsDirectoryW
FindResourceW
GetProcAddress
GetModuleHandleW
DecodePointer
RaiseException
CloseHandle
GetLastError
Wow64RevertWow64FsRedirection
InitializeCriticalSectionEx
Wow64DisableWow64FsRedirection
SetEndOfFile
ReadConsoleW
WriteConsoleW
HeapSize
SetStdHandle
FindNextFileW
FindFirstFileExW
FindClose
GetCommandLineA
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
GetProcessHeap
GetTimeZoneInformation
SetFilePointerEx
EnumSystemLocalesW
VirtualProtect
LoadResource
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
MultiByteToWideChar
FormatMessageW
LocalFree
WideCharToMultiByte
EnterCriticalSection
DeviceIoControl
LeaveCriticalSection
GetSystemTimeAsFileTime
QueryPerformanceCounter
VirtualFree
VirtualAlloc
TerminateProcess
CreateToolhelp32Snapshot
Process32NextW
GetCurrentThread
Process32FirstW
GetExitCodeProcess
Thread32Next
Thread32First
InitializeCriticalSection
CreateActCtxW
GetTempPathW
UnmapViewOfFile
GetTempFileNameW
CreateFileMappingW
ReleaseActCtx
MapViewOfFile
ResetEvent
QueueUserAPC
GetTickCount
LoadLibraryW
FreeLibrary
ActivateActCtx
GetEnvironmentVariableW
GetSystemDirectoryW
DeactivateActCtx
Module32FirstW
GetCurrentDirectoryW
ReadFile
CreateNamedPipeW
TerminateThread
SuspendThread
GetExitCodeThread
GetThreadTimes
OpenThread
OpenProcess
IsWow64Process
WriteProcessMemory
VirtualProtectEx
GetThreadContext
VirtualAllocEx
ReadProcessMemory
CreateRemoteThread
VirtualFreeEx
SetThreadContext
VirtualQueryEx
GetSystemInfo
GetStringTypeW
TryEnterCriticalSection
DuplicateHandle
WaitForSingleObjectEx
EncodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
OutputDebugStringW
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
GetVersionExW
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlPcToFileHeader
RtlUnwindEx
HeapAlloc
HeapFree
ExitThread
GetModuleHandleExW
HeapReAlloc
GetStdHandle
GetACP
GetFileType
GetConsoleCP
GetConsoleMode
GetDateFormatW
user32
DestroyIcon
LoadIconW
ChangeWindowMessageFilterEx
EnableMenuItem
wsprintfW
GetMessageW
CreateDialogParamW
CallWindowProcW
DestroyWindow
MessageBoxW
SetWindowLongPtrW
SendMessageW
EndDialog
SetWindowTextW
CreateWindowExW
ShowWindow
IsWindow
DispatchMessageW
IsDialogMessageW
TranslateAcceleratorW
TranslateMessage
SendMessageA
GetDlgItem
DialogBoxParamW
EnableWindow
GetWindowTextW
GetMenu
LoadAcceleratorsW
comdlg32
GetSaveFileNameW
GetOpenFileNameW
shell32
DragQueryFileW
CommandLineToArgvW
advapi32
RegOpenKeyW
SystemFunction036
RegEnumValueW
LookupPrivilegeValueW
OpenProcessToken
AdjustTokenPrivileges
RegCreateKeyW
RegSetValueExW
RegCloseKey
OpenThreadToken
ole32
CoCreateInstance
CoUninitialize
CoInitialize
Sections
.text Size: 623KB - Virtual size: 623KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 226KB - Virtual size: 226KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 311KB - Virtual size: 311KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ