marsstealer | e4d2abb64b06e33dbb6cb728370829dc332b4ea0affe03100b2670d386ad7038 | Triage

Sharing

General

Target

ba6e7e1e9161199cda53984e8797add7.bin
Size

292KB
Sample

240418-b9ff1sha8x
MD5

1374f241cbb67e8b43c8ce95de2e140d
SHA1

5e62d5edbae9d159025ebd6293b6e6022351b010
SHA256

e4d2abb64b06e33dbb6cb728370829dc332b4ea0affe03100b2670d386ad7038
SHA512

17cee2841001788ea584ca0d21072ffc5fff02e20670346202cc81d5fca0c868d5b036705eb601967163b8d8eeacd61294c230171ca59b4cd08e818db2c3b3ad
SSDEEP

6144:F21/IjU2Fe515tLeyGsztq56gEijLkKRhP+KMKFad2+nGij92Z6vNyj:01mvY51/aFsY8fiPRf63n1/vw

Score

10^/10

marsstealer default stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

Targets

- Target
  
  32429b9055e49788020d2baccfd472075a26cbdd1c70d0693150cdf963975775.exe
- Size
  
  619KB
- MD5
  
  ba6e7e1e9161199cda53984e8797add7
- SHA1
  
  c4ad796a18ffab0ef5f7df1a0db302114a4826d1
- SHA256
  
  32429b9055e49788020d2baccfd472075a26cbdd1c70d0693150cdf963975775
- SHA512
  
  7cda7fc206a871949955bdc5dba5f0d53673b637d5a48c42be2095b461b83a5916c43e4037eb77c353cf01838c860f3ab31ce8f5b38631088578de107eba9b66
- SSDEEP
  
  12288:K5XTI5PwjN7SJxjHhXXBVDgIQ7JMKjK5+GbKGvOs2JCo/bSJBoFnCMX6k:KppbjjaatFKk
Score

10^/10

marsstealer default stealer
- Mars Stealer
  An infostealer written in C++ based on other infostealers.
  stealer marsstealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

marsstealerdefaultstealer

behavioral2