MarsStealer - Analyse Statique Approfondie (03989d0a)

Hash	Valeur
SHA256	03989d0af03476f5611d18e2e8f6706be0d542707336c2b426035c78335f1328
MD5	43a6d187744810b00a60beaeea2c8074
Taille	275456 bytes

MarsStealer C2

C2: Tespit edilemedi

Port: 443

Tehdit Valeurlendirmesi

MarsStealer: Config tespit edilemedi. KEYDAL kSentinel.

MarsStealer — Profil du malware

MarsStealer, 2022 de ortaya cikan C++ tabanli infostealer ailesidir. RC2/XOR C2, tarayici, kripto cuzdan, Discord, Steam, 2FA token calma. AZORult varisi.

Type de malware

Infostealer

Langage de programmation

Protocole C2

HTTPS

Systèmes ciblés

Windows

Aussi connu sous (AKA)

Oski Stealer variant, Mars 2.9

Détails techniques

Mars Stealer is a C-based information stealer sold on underground forums since 2021. Successor to Oski Stealer (abandoned after developer arrest in 2020). Targets 40+ browser extensions including MetaMask, Coinbase Wallet, Ledger Live, Atomic, Exodus. Steals: browser passwords/cookies/autofill, screenshots, system info (hardware ID, username, OS), FileZilla/WinSCP credentials, Telegram sessions. Small footprint (~95KB), HTTP POST for exfiltration with base64+XOR encoding. Uses SQLite to parse browser credential stores. Delivered via cracked software downloads, fake Telegram/Discord bots, SEO poisoning. Web panel: SQLite backend, panel sold alongside stealer for ~$140.

Attribution / Acteur de la menace

Unknown (sold on XSS/Exploit.in forums)

Capacités et comportement

Tarayıcı Kimlik Bilgileri

Çerez Hırsızlığı

Kripto Cüzdan Çalma

Sistem Bilgisi

Ekran Görüntüsü

FTP/SSH İstemci Şifreleri

E-posta İstemcisi Çalma

Veri Sızıntısı

Liste IOC (2 indicateurs)

IOC — MarsStealer

# SHA256
03989d0af03476f5611d18e2e8f6706be0d542707336c2b426035c78335f1328 

# MD5
43a6d187744810b00a60beaeea2c8074

Type	Valeur	Note
sha256	03989d0af03476f5611d18e2e8f6706be0d542707336c2b426035c78335f1328	MarsStealer
md5	43a6d187744810b00a60beaeea2c8074	MarsStealer

MarsStealer — Voir le profil complet →