marsstealer | 9fba2c6f51319bc7585cd88948dfe4198a73a95d460d20f7c4ce54f892f84256 | Triage

Sharing

General

Target

ShellGPT4.exe
Size

4.0MB
Sample

231226-jptf5sfba6
MD5

c62f737ce988b95d667ccfebcfcab323
SHA1

d5a5f8aca605097e98163dd3163c9519fe2d5b7d
SHA256

9fba2c6f51319bc7585cd88948dfe4198a73a95d460d20f7c4ce54f892f84256
SHA512

d6fb67ffec3b2e1d0add413f715b6b27ae9c0c887f05a770e3e15984d11058796ebcdcc9840818f9484990ebfb75e8fef928d1f6812eef3e24cbbce70e86f977
SSDEEP

12288:fLplFN+msYJ2nCuWyEHx7YsvTZq7FUEpJBC:HC9WtZM

Score

10^/10

marsstealer default spyware stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

C2

www.moscow-post.ru/bark/wpadmin/admin.php

Targets

- Target
  
  ShellGPT4.exe
- Size
  
  4.0MB
- MD5
  
  c62f737ce988b95d667ccfebcfcab323
- SHA1
  
  d5a5f8aca605097e98163dd3163c9519fe2d5b7d
- SHA256
  
  9fba2c6f51319bc7585cd88948dfe4198a73a95d460d20f7c4ce54f892f84256
- SHA512
  
  d6fb67ffec3b2e1d0add413f715b6b27ae9c0c887f05a770e3e15984d11058796ebcdcc9840818f9484990ebfb75e8fef928d1f6812eef3e24cbbce70e86f977
- SSDEEP
  
  12288:fLplFN+msYJ2nCuWyEHx7YsvTZq7FUEpJBC:HC9WtZM
Score

10^/10

marsstealer default spyware stealer
- Mars Stealer
  An infostealer written in C++ based on other infostealers.
  stealer marsstealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

marsstealerdefaultspywarestealer

behavioral2

marsstealerdefaultstealer