Overview

overview

10

Static

static

3

l81rhzIPTi...1T.exe

windows7-x64

10

l81rhzIPTi...1T.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    l81rhzIPTizNWD6pnZPRSFEDal16Xy1T

  • Size

    13.4MB

  • Sample

    231225-ls1qqsbda7

  • MD5

    6e08d023664e3f4e835ec3ec198b883a

  • SHA1

    43f2f3321a51f1ca308af891d2e1dbaaee48b045

  • SHA256

    791cb146ce71d27b52dd233a80f5ac4e63f69d49af07a53850954da93ff439ad

  • SHA512

    41d44ed76ecda43eab891a2e07cb43481478c39797e44ed017654a8bca346b90bfcf4f444532d8e9765173c2e9b26d5f524fe42ec9a7830230fedbe21f9e0ec1

  • SSDEEP

    12288:bu5DqC9/n1D0jAV8eCeoIl1TroJMExsi+vakV7tbQ3KtwU:buDXVsUThTFyJm

Score
10/10
marsstealerdefaultstealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

C2

moscow-post.com/xaoniu/server/waungowangued/g.php

Targets

    • Target

      l81rhzIPTizNWD6pnZPRSFEDal16Xy1T

    • Size

      13.4MB

    • MD5

      6e08d023664e3f4e835ec3ec198b883a

    • SHA1

      43f2f3321a51f1ca308af891d2e1dbaaee48b045

    • SHA256

      791cb146ce71d27b52dd233a80f5ac4e63f69d49af07a53850954da93ff439ad

    • SHA512

      41d44ed76ecda43eab891a2e07cb43481478c39797e44ed017654a8bca346b90bfcf4f444532d8e9765173c2e9b26d5f524fe42ec9a7830230fedbe21f9e0ec1

    • SSDEEP

      12288:bu5DqC9/n1D0jAV8eCeoIl1TroJMExsi+vakV7tbQ3KtwU:buDXVsUThTFyJm

    Score
    10/10
    marsstealerdefaultstealer

    • Mars Stealer

      An infostealer written in C++ based on other infostealers.

      stealermarsstealer

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks