Overview

overview

10

Static

static

10

852-8-0x00...ry.exe

windows7-x64

10

852-8-0x00...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    852-8-0x0000000000400000-0x0000000000440000-memory.dmp

  • Size

    256KB

  • MD5

    06fbe331c09ca4d186c3de2903196ac8

  • SHA1

    f59716de3d48cbbeb0455fbb399a002930e6fd01

  • SHA256

    eb9e45503be88d988fa1f526e981b14ffa93440c5173db76a0d672b2b7441b3b

  • SHA512

    2e45f2c2e4172882e0f1f9aceda0908f47468b4ad99059f3efed870ebbf0f92f51dec3f992911862adec611d07b3d5cd98300a8edabc607ffb9919f6f36fc5ef

  • SSDEEP

    3072:3u/E8k9ZjpIn+zNch12KbAwSaSSJSp8yb8EGB9N7:+/E8k91rz6/tK8EGB9N

Score
10/10
defaultmarsstealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

C2

www.msk-post.com/server/init.php

Signatures

  • Marsstealer family
    marsstealer
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 852-8-0x0000000000400000-0x0000000000440000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections