Extracted

• • Target

    24adb4992ad63d101916088a48eaeb5f62a7a1ef35a28a02c0d34d0fab51e910.exe

  • Size

    2.1MB

  • MD5

    33b96fcceb00475b31415e2a2fe17ac5

  • SHA1

    b9412d4157d27757d173838e702044a270fc5c8d

  • SHA256

    24adb4992ad63d101916088a48eaeb5f62a7a1ef35a28a02c0d34d0fab51e910

  • SHA512

    1986c7951f0892f3c0a582bff8c5c7a92a146e84aeaa9030082e2bfaf159e01f349b759bbf48fa6d0e78a9edb20731f07fd4a374930f127ba817eeae96893c94

  • SSDEEP

    12288:4dlcbU3ucnv02SS8M9zNYhZB2/FoooEeBHoUojP:4vDb928tFWB4P

  Score

  10^/10

  marsstealerdefaultspywarestealer

  • Mars Stealer

    An infostealer written in C++ based on other infostealers.

    stealermarsstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2