| Hash | 값 |
|---|---|
| SHA256 | 18c7c5e7d5146bef12ead85598bf5d2c48ee5e6634d4769221d3e7712809f1ad |
| MD5 | 1cde32d54a0f0f2ddad79d7df6a7419f |
| 크기 | 227672 bytes |
MarsStealer C2
C2: Tespit edilemedi
Port: 443
Tehdit 값lendirmesi
MarsStealer: Config tespit edilemedi. KEYDAL kSentinel.
MarsStealer — 악성코드 프로필
MarsStealer, 2022 de ortaya cikan C++ tabanli infostealer ailesidir. RC2/XOR C2, tarayici, kripto cuzdan, Discord, Steam, 2FA token calma. AZORult varisi.
기술 세부 정보
Mars Stealer is a C-based information stealer sold on underground forums since 2021. Successor to Oski Stealer (abandoned after developer arrest in 2020). Targets 40+ browser extensions including MetaMask, Coinbase Wallet, Ledger Live, Atomic, Exodus. Steals: browser passwords/cookies/autofill, screenshots, system info (hardware ID, username, OS), FileZilla/WinSCP credentials, Telegram sessions. Small footprint (~95KB), HTTP POST for exfiltration with base64+XOR encoding. Uses SQLite to parse browser credential stores. Delivered via cracked software downloads, fake Telegram/Discord bots, SEO poisoning. Web panel: SQLite backend, panel sold alongside stealer for ~$140.
귀속 / 위협 행위자
Unknown (sold on XSS/Exploit.in forums)
기능 및 동작
IOC 목록 (2 개 지표)
# SHA256
18c7c5e7d5146bef12ead85598bf5d2c48ee5e6634d4769221d3e7712809f1ad
# MD5
1cde32d54a0f0f2ddad79d7df6a7419f
| 유형 | 값 | 메모 |
|---|---|---|
| sha256 | 18c7c5e7d5146bef12ead85598bf5d2c48ee5e6634d4769221d3e7712809f1ad | MarsStealer |
| md5 | 1cde32d54a0f0f2ddad79d7df6a7419f | MarsStealer |