marsstealer | 5452dc39044f0d4fc32236dda5c4ce986ae5aa33e6e1b653b3ed53fdf1ca745a | Triage

Sharing

General

Target

5452dc39044f0d4fc32236dda5c4ce986ae5aa33e6e1b653b3ed53fdf1ca745a.exe
Size

1.0MB
Sample

240416-z7bbaaed8z
MD5

588fe99f2631db84a27bbfceca342f8c
SHA1

84349b654c2f549d85dff6c3a548c7e11f79a5e3
SHA256

5452dc39044f0d4fc32236dda5c4ce986ae5aa33e6e1b653b3ed53fdf1ca745a
SHA512

d00d71d1d1bb8699727914a39190414f332c5be706f66b39ad1b1b8044c2ee7aec17511d784c864660c4c5230d51f69fc577b79ddc37d4c453a66f0bb25d9dfd
SSDEEP

12288:Me/cwY1icfinL+r3FI4PpJEtpnxnI+UejPFnOVy/:/YTr1IDtpnv9P

Score

10^/10

marsstealer default stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

Targets

- Target
  
  5452dc39044f0d4fc32236dda5c4ce986ae5aa33e6e1b653b3ed53fdf1ca745a.exe
- Size
  
  1.0MB
- MD5
  
  588fe99f2631db84a27bbfceca342f8c
- SHA1
  
  84349b654c2f549d85dff6c3a548c7e11f79a5e3
- SHA256
  
  5452dc39044f0d4fc32236dda5c4ce986ae5aa33e6e1b653b3ed53fdf1ca745a
- SHA512
  
  d00d71d1d1bb8699727914a39190414f332c5be706f66b39ad1b1b8044c2ee7aec17511d784c864660c4c5230d51f69fc577b79ddc37d4c453a66f0bb25d9dfd
- SSDEEP
  
  12288:Me/cwY1icfinL+r3FI4PpJEtpnxnI+UejPFnOVy/:/YTr1IDtpnv9P
Score

10^/10

marsstealer default stealer
- Mars Stealer
  An infostealer written in C++ based on other infostealers.
  stealer marsstealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

marsstealerdefaultstealer

behavioral2

marsstealerdefaultstealer