Overview

overview

10

Static

static

3

8996579058...e3.exe

windows7-x64

10

8996579058...e3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    82132dee9a07a607146d757091782517.bin

  • Size

    186KB

  • Sample

    240418-bxb8tsge7x

  • MD5

    747f63b7902202c24db40e7cbae78117

  • SHA1

    cf70bb88b324947a0602d7e7bf5a74a9aa03ec29

  • SHA256

    7c8a3fee6af3b2addadd83c7fa2a12fb47df73b9b54de07c4c56835edf74e344

  • SHA512

    645cf5a077201e10afc8e39b4bf7ccd5e9c7bdd8c644e2377fddc35b5621ecf83e2ae6bb18a287adc79087039e23d96ed0b19297b467a4e626de7f79e9057406

  • SSDEEP

    3072:aK43VenDNLOztKkBaDJFCRyYHytwZrgpCw5onDGfNoOUPPL:af3oL2tBBiMy4UIkpxonDj3L

Score
10/10
marsstealerdefaultstealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

Targets

    • Target

      8996579058ec9c3a04bd2496bd1807da60fb38c2ed8408c626c5686119cdc8e3.exe

    • Size

      3.4MB

    • MD5

      82132dee9a07a607146d757091782517

    • SHA1

      6b74a77a35f5e60d94541fdc49b63716d0224e46

    • SHA256

      8996579058ec9c3a04bd2496bd1807da60fb38c2ed8408c626c5686119cdc8e3

    • SHA512

      4814c9e8a1c536c05abf72e0c83e58e2632a9b5a0248b295bb7752810634549d7191d152949bf7e433221b87c40858679c14cdaacb1f75b38ca4b97ff1a833b4

    • SSDEEP

      12288:hFyN37FMCwa/5zCoehaSiNM5JWFnOVyVI:jqADNqPC

    Score
    10/10
    marsstealerdefaultstealer

    • Mars Stealer

      An infostealer written in C++ based on other infostealers.

      stealermarsstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks