Overview

overview

10

Static

static

3

791cb146ce...ad.exe

windows7-x64

10

791cb146ce...ad.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6e08d023664e3f4e835ec3ec198b883abin.zip

  • Size

    270KB

  • Sample

    240103-r47w3sfaep

  • MD5

    6dd526dc1168f6518d3d522cb0c66559

  • SHA1

    a59ee274adeb3ee04b1623c95b2ab91a9c557167

  • SHA256

    6a0b98e152b8f618d9c6d82ed37034cc0b87404fcbec9fb8edf6b6847f7f75a0

  • SHA512

    6484c7594741fb93cf1b8e749f597011c27b207deb502e2c090f778402aa4c8f64dda0f0dfd0ad9e61cf5ca43657cfdf1510afb18ad7d337137d26024fa73f99

  • SSDEEP

    6144:0ntjq4zgOfEQVTt8ZHudGU8Y7Svzn9Qp0zPAIfu8IMAw2fBH9uFojSyv00YK:0ntjqZOfEciZHudyhQp0zPBGTMPGHUFm

Score
10/10
marsstealerdefaultspywarestealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

C2

moscow-post.com/xaoniu/server/waungowangued/g.php

Targets

    • Target

      791cb146ce71d27b52dd233a80f5ac4e63f69d49af07a53850954da93ff439ad.exe

    • Size

      13.4MB

    • MD5

      6e08d023664e3f4e835ec3ec198b883a

    • SHA1

      43f2f3321a51f1ca308af891d2e1dbaaee48b045

    • SHA256

      791cb146ce71d27b52dd233a80f5ac4e63f69d49af07a53850954da93ff439ad

    • SHA512

      41d44ed76ecda43eab891a2e07cb43481478c39797e44ed017654a8bca346b90bfcf4f444532d8e9765173c2e9b26d5f524fe42ec9a7830230fedbe21f9e0ec1

    • SSDEEP

      12288:bu5DqC9/n1D0jAV8eCeoIl1TroJMExsi+vakV7tbQ3KtwU:buDXVsUThTFyJm

    Score
    10/10
    marsstealerdefaultspywarestealer

    • Mars Stealer

      An infostealer written in C++ based on other infostealers.

      stealermarsstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks