Overview

overview

10

Static

static

3

911221ce52...48.exe

windows7-x64

10

911221ce52...48.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    40cf5b7e5c505da78a7f66d2950effbf.bin

  • Size

    206KB

  • Sample

    231225-bqvrlaadf4

  • MD5

    052279dc37a4d4ef840cea98c66b368b

  • SHA1

    67dd3febb7a9b578ec0b0636576d10a9c088748c

  • SHA256

    2036928122f63d2ce88ba94aa48f0e2e42af769d2731118e441b568fb7866182

  • SHA512

    6ee19882aa457c704d590292f3b13bf374053c18d829a0226c99f07cac9822c6c4920345e86f47548c06ebf49d83eb2b001ea3e2dd7c596f32734a84048a0a78

  • SSDEEP

    3072:LLMwCux95Q/ELGbRaikYckCluoiRVX2wb6xf/doLw69r4tllEPZBwj+S/X4gblDN:LE6bQ4Gdhk5TCOxdoLws2llR/XZJgtoj

Score
10/10
marsstealerdefaultspywarestealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

C2

www.moscow-post.com/wp-content/plugins/toocreate/tuzerfd.php

Targets

    • Target

      911221ce521f77139ecfa2a277c277aaee6bff7094d9c5b31b893a4b104dea48.exe

    • Size

      433KB

    • MD5

      40cf5b7e5c505da78a7f66d2950effbf

    • SHA1

      abf961c5b9fae57411a195a00b4c7093d2fe0bc4

    • SHA256

      911221ce521f77139ecfa2a277c277aaee6bff7094d9c5b31b893a4b104dea48

    • SHA512

      08cbfc073c2d0f63a9b2711a81dd30809cb87eb2310ffd5b2a582a1e9ca0ebd5956093e83453310cba25a403aa28bf7cfcb3725a017188d48e66cccccb190bc5

    • SSDEEP

      12288:pyVG1u73Do/eGm5uRWlgfS7BCag7MJQIGhJNsx61V0wrY4FS9:IGS6WRN+JGxS

    Score
    10/10
    marsstealerdefaultspywarestealer

    • Mars Stealer

      An infostealer written in C++ based on other infostealers.

      stealermarsstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks