Extracted

• • Target

    791cb146ce71d27b52dd233a80f5ac4e63f69d49af07a53850954da93ff439ad.exe

  • Size

    13.4MB

  • MD5

    6e08d023664e3f4e835ec3ec198b883a

  • SHA1

    43f2f3321a51f1ca308af891d2e1dbaaee48b045

  • SHA256

    791cb146ce71d27b52dd233a80f5ac4e63f69d49af07a53850954da93ff439ad

  • SHA512

    41d44ed76ecda43eab891a2e07cb43481478c39797e44ed017654a8bca346b90bfcf4f444532d8e9765173c2e9b26d5f524fe42ec9a7830230fedbe21f9e0ec1

  • SSDEEP

    12288:bu5DqC9/n1D0jAV8eCeoIl1TroJMExsi+vakV7tbQ3KtwU:buDXVsUThTFyJm

  Score

  10^/10

  marsstealerdefaultspywarestealer

  • Mars Stealer

    An infostealer written in C++ based on other infostealers.

    stealermarsstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2