BLACK FRIDAY: 2-for-1 offer NOVEMBER 20 - 26 See details

Mars Stealer

80
Global rank
47 infographic chevron month
Month rank
86 infographic chevron week
Week rank
59
IOCs

Mars Stealer is a malware program designed to steal sensitive information from infected systems. It can access browser credentials, cryptocurrency wallets, and system information. The malware utilizes advanced evasion techniques and transmits stolen data securely through a C&C server.

Stealer
Type
ex-USSR
Origin
1 June, 2021
First seen
7 April, 2024
Last seen

How to analyze Mars Stealer with ANY.RUN

Type
ex-USSR
Origin
1 June, 2021
First seen
7 April, 2024
Last seen

IOCs

Hashes
abbc07cd191520417e647a50492373d8f48e0a4f26f04f372f856db8e266462e
b4863f01390b14e5be2f0d510223a3a704d3cab49f5013af73b60097a64403d9
3e8fd15057bf76c51853b4a03f505c85588d13826fd417f9f15b653a9cce49c6
7083052576ebdd75079d25251f24df243395476e0386c25656937a24b6865759
d7c4d6e5ae6f07976416f5182b42252d7421d2277bbd140ac4fd72a278bbe4de
f77bcd1d604e33564039585d2c5235ea27fdd36ef53ab67fff0c646de73362c6
21633dc789d4b162040336f309194782d7976f60ebb379d6325cc04c21346572
2f1dbad2bc8a6b152996dcb415f01ff0350e75119663914aade45be5beb3f024
7fa65bb78bb3b56024b3a1399f6a767b6066ac571a68ec6719085bce7097d0df
Domains
dispatchweekly.com14baef17b6d04c23.php
URLs
http://kenesrakishev.net/wp-includes/pomo/po.php
http://kenesrakishev.net/wp-load.php
http://kenesrakishev.net/wp-admin/admin-ajax.php
http://rakishevkenes.com:443/wp-admin/admin-ajax.php
http://rakishevkenes.com/wp-admin/admin-ajax.php
http://mars.mhsorteio.app.br/APwpnHWkYh.php
http://couriercare.in/18/gate.php
http://www.msk-post.com/server/init.php
http://mail.moscow-post.com/blog/blogger.php
http://gg.gemkan.online/gate.php
http://couriercare.in/2/gate.php
http://www.moscow-post.ru/bark/wpadmin/admin.php
http://www.moscow-post.ru/ryuka/grocktack/fdzeiw.php
http://moscow-post.com/xaoniu/server/waungowangued/g.php
http://moscow-post.ru/patch/server/udryhdj.php
http://moscow-post.com/log/loger.php
http://test.moscow-post.su/log.php
http://www.moscow-post.com/wp-content/plugins/toocreate/tuzerfd.php
http://www.moscow-post.su/su/wp-content/lozzz.php
http://moscow-post.ru/blogggg/blogger.php
Last Seen at

Recent blog posts

post image
Malware Trends Report: Q1, 2024
watchers 166
comments 0
post image
Understand Encryption in Malware: From Basics...
watchers 553
comments 0
post image
ANY.RUN for Enterprises: Learn About Our Most...
watchers 301
comments 0

What is malware: Mars Stealer?

First identified in June 2021, Mars Stealer is a type of malicious software primarily focused on collecting sensitive information from browsers and cryptocurrency wallets for transmission to attackers. Written in ASM/C, the malware was initially sold through Dark Web forums as a malware-as-a-service on a subscription basis. It shared similar features with other malware like Oski Stealer, Arkei, and Vidar.

While the malware appeared to have stopped functioning in 2022, with reports of unresponsive developers, evidence suggests that the original creators of Mars Stealer remain active in 2024 and continue to exploit the malware for malicious purposes.

Get started today for free

Easily analyze emerging malware with ANY.RUN interactive online sandbox

Register for free

Mars Stealer malicious software technical details

Information theft constitutes the core focus of Mars Staler:

  • Browser Credentials: It steals login credentials from popular browsers like Firefox, Chrome, Opera, and Internet Explorer using predefined paths to locate and extract data like usernames and passwords.
  • 2FA and Crypto Extension Data: Focusing specifically on Chromium-based browsers, Mars Stealer can hijack two-factor authentication (2FA) plugins and cryptocurrency extensions.
  • Cryptocurrency Wallet Targeting: It targets popular wallets like MetaMask and Binance Wallet, seeking information such as private keys.
  • Extensive System Information Collection: Mars Stealer also gathers comprehensive system information, including IPs, OS details, software installed on compromised systems, and usernames.
  • Screenshot Capture: The malware also captures a screenshot of every infected system.

Mars Stealer establishes a secure connection with its Command & Control (C&C) server using SSL encryption. This encrypted communication channel allows the malware to receive instructions, download configurations and libraries, and exfiltrate stolen data without raising red flags. The information collected by the malware is compressed into a ZIP archive before being exfiltrated to the C&C server.

Mars Stealer employs various evasion techniques to escape detection and analysis. For instance, it masks its WinApi calls and encrypts strings. To prevent multiple instances of the malware from running concurrently, Mars Stealer creates a mutex object. The virus employs a custom file grabber with configuration parsing capabilities, allowing for flexible targeting of specific files and directories.

The malware includes a special feature that checks every machine before attempting infection to identify whether it is located in one of the countries that belong to the Commonwealth of Independent States (CIS). This likely points to the fact that the creators of Mars Stealer hail from the same region.

Mars Stealer execution process

It’s time to have a better look at Mars Stealer by uploading its sample to the ANY.RUN sandbox for closer inspection.

As perpetrators endeavor to conceal their activities, the Mars Stealer employs a deliberately straightforward execution chain to minimize visibility. Consequently, the infected operating system experiences a limited number of processes, and the malware refrains from utilizing system tools. Once the payload infiltrates the compromised system, it promptly initiates its execution.

The analyzed sample initiates a process executing all malicious activities, including data theft and communication with the Command and Control (C&C) server. Malware was detected, and the configuration was successfully extracted.

Mars config shown in ANY.RUN Mars Stealer's configuration demonstrated in ANY.RUN

Mars Stealer malware distribution methods

When it comes to distribution methods, a typical attack in the case of Mars Stealer starts from spam campaigns or fake websites advertising legitimate software. For instance, in 2022, one of the campaigns to distribute Mars Stealer used a website promoting Atomic Wallet, a popular cryptocurrency wallet. After clicking on the “download” button on the website, users would receive a .zip file which contains a sample of Mars Stealer.

The malware was also commonly dropped by loaders, malicious software designed specifically for spreading different malware families on devices they manage to infect. One of the examples here is PrivateLoader.

Conclusion

With malware infections being at an all time high, it becomes important to stay vigilant and exercise caution when encountering any suspicious emails, websites, or software downloads to avoid falling victim to Mars Stealer or similar malware threats, as well as to maintain protection of your infrastructure.

ANY.RUN, a cloud-based sandbox, offers accurate threat detection, along with detailed reports on their technical characteristics. It lets you scan any suspicious file and check potentially malicious URLs to ensure informed decision-making and timely removal of any traces of the malware.

Try ANY.RUN for free – register now!

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Agent Tesla screenshot
Agent Tesla
agenttesla trojan rat stealer
Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.
Read More
Amadey screenshot
Amadey
amadey
Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.
Read More
Arkei screenshot
Arkei
arkei stealer
Arkei is a stealer type malware capable of collecting passwords, autosaved forms, cryptocurrency wallet credentials, and files.
Read More
AsyncRAT screenshot
AsyncRAT
asyncrat
AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.
Read More
WarZone screenshot
WarZone
warzone avemaria stealer trojan rat
WarZone RAT is a remote access trojan, which is written in C++ and offered as a malware-as-a-service. It packs a wide range of capabilities, from stealing victims’ files and passwords to capturing desktop activities. WarZone RAT is primarily distributed via phishing emails and receives regular updates from its C2.
Read More

Our website uses cookies. By visiting the pages of the site, you agree to our Privacy Policy