General

  • Target

    a3e2fbe15176a56ac45f26368b80b3fc.exe

  • Size

    159KB

  • Sample

    231229-m7ebqagec6

  • MD5

    a3e2fbe15176a56ac45f26368b80b3fc

  • SHA1

    a0431e50317a2c6c94aade1a10be6f20f62ad436

  • SHA256

    61b5c2f0dd54539e5baea9155aaca72c8fd6f12279083511d4d3eccd9e360f9b

  • SHA512

    26f7e48275c7565405ca94a15b0414acfbc824979627ed9b48d3dfc5360e8c0cd93227f00df9ed54435ab79a84b0771a0323a6e37448ff15481ed84b92a2f3ac

  • SSDEEP

    3072:UemE6vyiPCkN0sVKOUP+qU16bQGTt/OgmyNFrnPKDNJSp8Bb8EG:UrSUm+TNG5/Og9frnW8EG

Malware Config

Extracted

Family

marsstealer

Botnet

Default

C2

couriercare.in/2/gate.php

Targets

    • Target

      a3e2fbe15176a56ac45f26368b80b3fc.exe

    • Size

      159KB

    • MD5

      a3e2fbe15176a56ac45f26368b80b3fc

    • SHA1

      a0431e50317a2c6c94aade1a10be6f20f62ad436

    • SHA256

      61b5c2f0dd54539e5baea9155aaca72c8fd6f12279083511d4d3eccd9e360f9b

    • SHA512

      26f7e48275c7565405ca94a15b0414acfbc824979627ed9b48d3dfc5360e8c0cd93227f00df9ed54435ab79a84b0771a0323a6e37448ff15481ed84b92a2f3ac

    • SSDEEP

      3072:UemE6vyiPCkN0sVKOUP+qU16bQGTt/OgmyNFrnPKDNJSp8Bb8EG:UrSUm+TNG5/Og9frnW8EG

    • Mars Stealer

      An infostealer written in C++ based on other infostealers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v13

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

2
T1005

Tasks