marsstealer | 1692ae8b8767f531c364d9e0c2989785423b067f15379ced81f32b7d40f3e6d4 | Triage

Sharing

General

Target

a3e2fbe15176a56ac45f26368b80b3fc.bin
Size

113KB
Sample

231231-cbrl3ahhdm
MD5

b2786c9916547bc63b6579b36936a272
SHA1

124359d1d95eed5fcee37907e50e093059dce670
SHA256

1692ae8b8767f531c364d9e0c2989785423b067f15379ced81f32b7d40f3e6d4
SHA512

f10c1598ab16b3f145842d31e20047e63effd7cde45dc0e1db32f9fe809be9fe63f56e9bab3c5ec6938b531020d062a4f096c2e699708684c611ed466f250a91
SSDEEP

3072:eG7Ocxe1SkF13m7qqXMzhjd68VyF305P3qh:etcx+1YqC+5P3qh

Score

10^/10

marsstealer default spyware stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

C2

couriercare.in/2/gate.php

Targets

- Target
  
  61b5c2f0dd54539e5baea9155aaca72c8fd6f12279083511d4d3eccd9e360f9b.exe
- Size
  
  159KB
- MD5
  
  a3e2fbe15176a56ac45f26368b80b3fc
- SHA1
  
  a0431e50317a2c6c94aade1a10be6f20f62ad436
- SHA256
  
  61b5c2f0dd54539e5baea9155aaca72c8fd6f12279083511d4d3eccd9e360f9b
- SHA512
  
  26f7e48275c7565405ca94a15b0414acfbc824979627ed9b48d3dfc5360e8c0cd93227f00df9ed54435ab79a84b0771a0323a6e37448ff15481ed84b92a2f3ac
- SSDEEP
  
  3072:UemE6vyiPCkN0sVKOUP+qU16bQGTt/OgmyNFrnPKDNJSp8Bb8EG:UrSUm+TNG5/Og9frnW8EG
Score

10^/10

marsstealer default spyware stealer
- Mars Stealer
  An infostealer written in C++ based on other infostealers.
  stealer marsstealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

marsstealerdefaultspywarestealer

behavioral2

marsstealerdefaultspywarestealer