Overview
overview
10Static
static
10Mars Steal...PC.exe
windows7-x64
10Mars Steal...PC.exe
windows10-2004-x64
10Mars Steal...nu.exe
windows7-x64
3Mars Steal...nu.exe
windows10-2004-x64
3mars_panel...n.html
windows7-x64
3mars_panel...n.html
windows10-2004-x64
3mars_panel...l.html
windows7-x64
3mars_panel...l.html
windows10-2004-x64
3mars_panel...te.ps1
windows7-x64
3mars_panel...te.ps1
windows10-2004-x64
3mars_panel...min.js
windows7-x64
3mars_panel...min.js
windows10-2004-x64
3mars_panel...nit.js
windows7-x64
3mars_panel...nit.js
windows10-2004-x64
3mars_panel...min.js
windows7-x64
3mars_panel...min.js
windows10-2004-x64
3mars_panel...n.html
windows7-x64
3mars_panel...n.html
windows10-2004-x64
3mars_panel...min.js
windows7-x64
3mars_panel...min.js
windows10-2004-x64
3mars_panel...min.js
windows7-x64
3mars_panel...min.js
windows10-2004-x64
3mars_panel...app.js
windows7-x64
3mars_panel...app.js
windows10-2004-x64
3mars_panel...min.js
windows7-x64
3mars_panel...min.js
windows10-2004-x64
3mars_panel...ker.js
windows7-x64
3mars_panel...ker.js
windows10-2004-x64
3mars_panel...min.js
windows7-x64
3mars_panel...min.js
windows10-2004-x64
3mars_panel...min.js
windows7-x64
3mars_panel...min.js
windows10-2004-x64
3Analysis
-
max time kernel
92s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2024 21:32
Behavioral task
behavioral1
Sample
Mars Stealer Builder.h/MarsStealer8_cracked_by_LLCPPC.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Mars Stealer Builder.h/MarsStealer8_cracked_by_LLCPPC.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Mars Stealer Builder.h/MarsStealer_Menu.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Mars Stealer Builder.h/MarsStealer_Menu.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
mars_panel_v8/instruction.html
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
mars_panel_v8/instruction.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
mars_panel_v8/manul_panel.html
Resource
win7-20241023-en
Behavioral task
behavioral8
Sample
mars_panel_v8/manul_panel.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
mars_panel_v8/www/gate.ps1
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
mars_panel_v8/www/gate.ps1
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
mars_panel_v8/www/guest/assets/js/apexcharts.min.js
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
mars_panel_v8/www/guest/assets/js/apexcharts.min.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
mars_panel_v8/www/guest/assets/js/jquery.analytics_dashboard.init.js
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
mars_panel_v8/www/guest/assets/js/jquery.analytics_dashboard.init.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
mars_panel_v8/www/guest/assets/js/jquery.min.js
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
mars_panel_v8/www/guest/assets/js/jquery.min.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
mars_panel_v8/www/panel/assets/css/jquery-ui.min.html
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
mars_panel_v8/www/panel/assets/css/jquery-ui.min.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
mars_panel_v8/www/panel/assets/js/FileSaver.min.js
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
mars_panel_v8/www/panel/assets/js/FileSaver.min.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
mars_panel_v8/www/panel/assets/js/apexcharts.min.js
Resource
win7-20241023-en
Behavioral task
behavioral22
Sample
mars_panel_v8/www/panel/assets/js/apexcharts.min.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
mars_panel_v8/www/panel/assets/js/app.js
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
mars_panel_v8/www/panel/assets/js/app.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
mars_panel_v8/www/panel/assets/js/bootstrap-colorpicker.min.js
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
mars_panel_v8/www/panel/assets/js/bootstrap-colorpicker.min.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
mars_panel_v8/www/panel/assets/js/bootstrap-material-datetimepicker.js
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
mars_panel_v8/www/panel/assets/js/bootstrap-material-datetimepicker.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
mars_panel_v8/www/panel/assets/js/bootstrap-maxlength.min.js
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
mars_panel_v8/www/panel/assets/js/bootstrap-maxlength.min.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
mars_panel_v8/www/panel/assets/js/bootstrap.bundle.min.js
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
mars_panel_v8/www/panel/assets/js/bootstrap.bundle.min.js
Resource
win10v2004-20241007-en
General
-
Target
Mars Stealer Builder.h/MarsStealer8_cracked_by_LLCPPC.exe
-
Size
159KB
-
MD5
caa1ddfbbe03a5a5daeb718605daacb0
-
SHA1
1dc62e3529aaafb20c3ca16697deb5cf6792d83f
-
SHA256
fcec85746f0f2a92b1268830d6d0b075eb9080707358b93ba5fbd917b1a0a8ea
-
SHA512
fb805afdf01603eb5af3ee8807fcd42a04e49d3a106e945fa9ab57a68a5068bdfc19a685213d3601be228dfbfae52315953e2400be9051a283f6df0923518ce7
-
SSDEEP
3072:Um/E8k9ZjpIL+zNch12KbAwSaSbJSp8Bb8EG:N/E8k91zz6/t88EG
Malware Config
Extracted
marsstealer
Default
Signatures
-
Mars Stealer
An infostealer written in C++ based on other infostealers.
-
Marsstealer family
-
Program crash 1 IoCs
pid pid_target Process procid_target 3380 3228 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MarsStealer8_cracked_by_LLCPPC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mars Stealer Builder.h\MarsStealer8_cracked_by_LLCPPC.exe"C:\Users\Admin\AppData\Local\Temp\Mars Stealer Builder.h\MarsStealer8_cracked_by_LLCPPC.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3228 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 11242⤵
- Program crash
PID:3380
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3228 -ip 32281⤵PID:804