HashЗначение
SHA25618c7c5e7d5146bef12ead85598bf5d2c48ee5e6634d4769221d3e7712809f1ad
MD51cde32d54a0f0f2ddad79d7df6a7419f
Размер227672 bytes

MarsStealer C2

C2: Tespit edilemedi

Port: 443

Tehdit Значениеlendirmesi

MarsStealer: Config tespit edilemedi. KEYDAL kSentinel.

MarsStealer — Профиль вредоносного ПО

MarsStealer, 2022 de ortaya cikan C++ tabanli infostealer ailesidir. RC2/XOR C2, tarayici, kripto cuzdan, Discord, Steam, 2FA token calma. AZORult varisi.

Тип вредоносного ПО
Infostealer
Язык программирования
C
C2 Протокол
HTTPS
Целевые системы
Windows
Другие названия (AKA)
Oski Stealer variant, Mars 2.9

Технические детали

Mars Stealer is a C-based information stealer sold on underground forums since 2021. Successor to Oski Stealer (abandoned after developer arrest in 2020). Targets 40+ browser extensions including MetaMask, Coinbase Wallet, Ledger Live, Atomic, Exodus. Steals: browser passwords/cookies/autofill, screenshots, system info (hardware ID, username, OS), FileZilla/WinSCP credentials, Telegram sessions. Small footprint (~95KB), HTTP POST for exfiltration with base64+XOR encoding. Uses SQLite to parse browser credential stores. Delivered via cracked software downloads, fake Telegram/Discord bots, SEO poisoning. Web panel: SQLite backend, panel sold alongside stealer for ~$140.

Атрибуция / Актор угрозы

Unknown (sold on XSS/Exploit.in forums)

Возможности и поведение

Tarayıcı Kimlik Bilgileri
Çerez Hırsızlığı
Kripto Cüzdan Çalma
Sistem Bilgisi
Ekran Görüntüsü
FTP/SSH İstemci Şifreleri
E-posta İstemcisi Çalma
Veri Sızıntısı

Список IOC (2 индикаторов)

IOC — MarsStealer
# SHA256 18c7c5e7d5146bef12ead85598bf5d2c48ee5e6634d4769221d3e7712809f1ad # MD5 1cde32d54a0f0f2ddad79d7df6a7419f
ТипЗначениеПримечание
sha256 18c7c5e7d5146bef12ead85598bf5d2c48ee5e6634d4769221d3e7712809f1ad MarsStealer
md5 1cde32d54a0f0f2ddad79d7df6a7419f MarsStealer
MarsStealer — Полный профиль →
Теги
mars-stealermalwareanalizstatik