Extracted

• • Target

    02752953a097c95cf337c77af8ec8f4526983138e1e0cf07e0ad1ed7be885c2e

  • Size

    614KB

  • MD5

    57f9d870b05d59a7e79816ef5e8fe70e

  • SHA1

    e5f2d86139d9a847663b2cd0c68716e85678177d

  • SHA256

    02752953a097c95cf337c77af8ec8f4526983138e1e0cf07e0ad1ed7be885c2e

  • SHA512

    9dc3849575caa0337645f7f24d4d7720375857875a26dad839512de6aa3dc2d49f7bbf2138c7c09aa94e37ce94b0f1f370eafca3bc89faba46bd13b1073f40c2

  • SSDEEP

    12288:6jLIHe+qdOqQ/H6OKnA5feEq8sdvuxi+vC/tKJ+2BAMSsjgZeS1I/XUta93poy:CRtwtvagbCy

  Score

  10^/10

  spywarestealermarsstealerdefault

  • Mars Stealer

    An infostealer written in C++ based on other infostealers.

    stealermarsstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2