marsstealer | 589305885aaab6c93b35fa797316b063a6f4ee3c86a5151a6cb19f2c875c830c | Triage

Sharing

General

Target

bd424a7fd1d0dbb18047473d25acf79d.bin
Size

215KB
Sample

231224-dpckqsebfr
MD5

2cbb76acb1042c0f07ba8c601ce82a8b
SHA1

718904e3ee518e737a77d674516ddc2c10825276
SHA256

589305885aaab6c93b35fa797316b063a6f4ee3c86a5151a6cb19f2c875c830c
SHA512

4ff547fc6b868cd2f3a9dd8ae687b2267b2040a1725b2ae5626ce5c0c10fbe1a534d439d112a0aa15063c27fec65666897989993f4028fd71dd42264d45e1b3f
SSDEEP

3072:KPfEiPBxMeCD9yuy0orYKi5WUvu7BM92TUS9+ifSkwL0RX+ualwtuUPNmZWS:KkiPBGEYorZiO7q9E+ifkoZ+AQ4S

Score

10^/10

marsstealer default spyware stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

Targets

- Target
  
  76db9e74e9f0384c822b933a464cbc1f63b4c9a0a0b064774f09d8ee946d800c.exe
- Size
  
  5.7MB
- MD5
  
  bd424a7fd1d0dbb18047473d25acf79d
- SHA1
  
  c663dcda2f85b9e43cb2160e8e6387657091e666
- SHA256
  
  76db9e74e9f0384c822b933a464cbc1f63b4c9a0a0b064774f09d8ee946d800c
- SHA512
  
  f7bd8928aa9b088a088897c14e6cbf87f6b36d024217fca360487ca8a3e8fe0c37080c3efe31f9502ba76aeffefdb5af66d51ca3ab4b986387bbccda53ee354f
- SSDEEP
  
  12288:OmOcdB+QGf79+kXqfDRjagi+Ug/NqTRxGrXnlJHmjEMnsL4pYZynND:nBcgAnRinrmb
Score

10^/10

marsstealer default spyware stealer
- Mars Stealer
  An infostealer written in C++ based on other infostealers.
  stealer marsstealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

marsstealerdefaultspywarestealer

behavioral2