MarsStealer - Tiefe Statische Analyse (c24d3ad6)

Hash	Wert
SHA256	c24d3ad6c8178c5066eea814986ce73e26d6ec2812fc6f56b0275eb68da0f6bb
MD5	77ffb6074913525f5ae6666d4c54fb09
Größe	282624 bytes

MarsStealer C2

C2: Tespit edilemedi

Port: 443

Tehdit Wertlendirmesi

MarsStealer: Config tespit edilemedi. KEYDAL kSentinel.

MarsStealer — Malware-Profil

MarsStealer, 2022 de ortaya cikan C++ tabanli infostealer ailesidir. RC2/XOR C2, tarayici, kripto cuzdan, Discord, Steam, 2FA token calma. AZORult varisi.

Malware-Typ

Infostealer

Programmiersprache

C2-Protokoll

HTTPS

Zielsysteme

Windows

Auch bekannt als (AKA)

Oski Stealer variant, Mars 2.9

Technische Details

Mars Stealer is a C-based information stealer sold on underground forums since 2021. Successor to Oski Stealer (abandoned after developer arrest in 2020). Targets 40+ browser extensions including MetaMask, Coinbase Wallet, Ledger Live, Atomic, Exodus. Steals: browser passwords/cookies/autofill, screenshots, system info (hardware ID, username, OS), FileZilla/WinSCP credentials, Telegram sessions. Small footprint (~95KB), HTTP POST for exfiltration with base64+XOR encoding. Uses SQLite to parse browser credential stores. Delivered via cracked software downloads, fake Telegram/Discord bots, SEO poisoning. Web panel: SQLite backend, panel sold alongside stealer for ~$140.

Attribution / Bedrohungsakteur

Unknown (sold on XSS/Exploit.in forums)

Fähigkeiten & Verhalten

Tarayıcı Kimlik Bilgileri

Çerez Hırsızlığı

Kripto Cüzdan Çalma

Sistem Bilgisi

Ekran Görüntüsü

FTP/SSH İstemci Şifreleri

E-posta İstemcisi Çalma

Veri Sızıntısı

IOC-Liste (2 Indikatoren)

IOC — MarsStealer

# SHA256
c24d3ad6c8178c5066eea814986ce73e26d6ec2812fc6f56b0275eb68da0f6bb 

# MD5
77ffb6074913525f5ae6666d4c54fb09

Typ	Wert	Bemerkung
sha256	c24d3ad6c8178c5066eea814986ce73e26d6ec2812fc6f56b0275eb68da0f6bb	MarsStealer
md5	77ffb6074913525f5ae6666d4c54fb09	MarsStealer

MarsStealer — Zum vollständigen Profil →