| Hash | 值 |
|---|---|
| SHA256 | 8c54ba3429e3f5a65b6b31b84bcfc6d2b4b91cc385e50a5e656f92278603a421 |
| MD5 | 1d9c0bb1ce6bef3f05a5654e60f68008 |
| 大小 | 1788416 bytes |
MarsStealer C2
C2: Tespit edilemedi
Port: 443
Tehdit 值lendirmesi
MarsStealer: Config tespit edilemedi. KEYDAL kSentinel.
MarsStealer — 恶意软件档案
MarsStealer, 2022 de ortaya cikan C++ tabanli infostealer ailesidir. RC2/XOR C2, tarayici, kripto cuzdan, Discord, Steam, 2FA token calma. AZORult varisi.
技术细节
Mars Stealer is a C-based information stealer sold on underground forums since 2021. Successor to Oski Stealer (abandoned after developer arrest in 2020). Targets 40+ browser extensions including MetaMask, Coinbase Wallet, Ledger Live, Atomic, Exodus. Steals: browser passwords/cookies/autofill, screenshots, system info (hardware ID, username, OS), FileZilla/WinSCP credentials, Telegram sessions. Small footprint (~95KB), HTTP POST for exfiltration with base64+XOR encoding. Uses SQLite to parse browser credential stores. Delivered via cracked software downloads, fake Telegram/Discord bots, SEO poisoning. Web panel: SQLite backend, panel sold alongside stealer for ~$140.
归因 / 威胁行为者
Unknown (sold on XSS/Exploit.in forums)
能力与行为
IOC列表 (2 个指标)
# SHA256
8c54ba3429e3f5a65b6b31b84bcfc6d2b4b91cc385e50a5e656f92278603a421
# MD5
1d9c0bb1ce6bef3f05a5654e60f68008
| 类型 | 值 | 备注 |
|---|---|---|
| sha256 | 8c54ba3429e3f5a65b6b31b84bcfc6d2b4b91cc385e50a5e656f92278603a421 | MarsStealer |
| md5 | 1d9c0bb1ce6bef3f05a5654e60f68008 | MarsStealer |