File name:

Mars_Stealer_8_cracked.rar

Full analysis: https://app.any.run/tasks/28bbe50c-707c-4450-8743-66edab2d4d21
Verdict: Malicious activity
Threats:

Arkei is a stealer type malware capable of collecting passwords, autosaved forms, cryptocurrency wallet credentials, and files.

Malware Trends Tracker     >>>
Analysis date: May 28, 2025, 16:28:07
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
telegram
marsstealer
stealer
arkei
crypto-regex
ims-api
generic
confuser
arch-scr
arch-doc
arch-html
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

1780799981F747AB82CBF1BF6BFB2507

SHA1:

CF3D9767EDCFA3B7FAE23583D813B03095C2B4A7

SHA256:

FCE0DA47BFBD01DB1D7AC96F3A207AC249E72B9C74B0E0B1DDAB31BA10C2C8A1

SSDEEP:

98304:g62IPNUfH7Mb2p6qer3obZRI61H42pPgmOEciJPlvG3Yc/amQZvBlp/gN2vrpL+K:pou/sCAtIYNnDulf/l7lkKK6/1C

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ARKEI has been detected (YARA)

      • MarsStealer8_cracked_by_LLCPPC.exe (PID: 3268)

    • MARSSTEALER has been detected (YARA)

      • MarsStealer8_cracked_by_LLCPPC.exe (PID: 3268)

    • Create files in the Startup directory

      • regasm.exe (PID: 5036)

    • Changes the autorun value in the registry

      • regasm.exe (PID: 5036)
      • regasm.exe (PID: 632)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 2568)

    • The process drops Mozilla's DLL files

      • WinRAR.exe (PID: 2568)

    • Reads security settings of Internet Explorer

      • MarsStealer8_cracked_by_LLCPPC.exe (PID: 3268)
      • MarsStealer_Menu.exe (PID: 6840)
      • oso.exe (PID: 5124)
      • MarsStealer_Menu.exe (PID: 7128)

    • Base64-obfuscated command line is found

      • MarsStealer_Menu.exe (PID: 6840)
      • MarsStealer_Menu.exe (PID: 7128)
      • MarsStealer_Menu.exe (PID: 7500)

    • Reads the date of Windows installation

      • MarsStealer_Menu.exe (PID: 6840)
      • MarsStealer_Menu.exe (PID: 7128)

    • BASE64 encoded PowerShell command has been detected

      • MarsStealer_Menu.exe (PID: 6840)
      • MarsStealer_Menu.exe (PID: 7128)
      • MarsStealer_Menu.exe (PID: 7500)

    • Starts POWERSHELL.EXE for commands execution

      • MarsStealer_Menu.exe (PID: 6840)
      • MarsStealer_Menu.exe (PID: 7128)
      • MarsStealer_Menu.exe (PID: 7500)

    • Executable content was dropped or overwritten

      • MarsStealer_Menu.exe (PID: 6840)
      • regasm.exe (PID: 5036)
      • oso.exe (PID: 5124)
      • MarsStealer_Menu.exe (PID: 6800)
      • MarsStealer_Menu.exe (PID: 7128)

    • The process creates files with name similar to system file names

      • regasm.exe (PID: 5036)
      • MarsStealer_Menu.exe (PID: 6840)
      • MarsStealer_Menu.exe (PID: 7128)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • regasm.exe (PID: 5036)
      • regasm.exe (PID: 632)

    • Executes application which crashes

      • MarsStealer8_cracked_by_LLCPPC.exe (PID: 3268)
      • MarsStealer_Menu.exe (PID: 7128)
      • MarsStealer_Menu.exe (PID: 7500)
      • MarsStealer8_cracked_by_LLCPPC.exe (PID: 900)
      • MarsStealer8_cracked_by_LLCPPC.exe (PID: 8092)

    • Found regular expressions for crypto-addresses (YARA)

      • regasm.exe (PID: 5036)
      • ctfmom.exe (PID: 6656)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • regasm.exe (PID: 5036)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2568)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 2568)

    • Checks supported languages

      • MarsStealer8_cracked_by_LLCPPC.exe (PID: 3268)
      • MarsStealer_Menu.exe (PID: 6840)
      • oso.exe (PID: 5124)
      • regasm.exe (PID: 5036)
      • MarsStealer_Menu.exe (PID: 6800)
      • MSBuild.exe (PID: 2660)
      • MarsStealer_Menu.exe (PID: 7128)
      • oso.exe (PID: 496)
      • ctfmom.exe (PID: 6656)
      • regasm.exe (PID: 632)
      • MSBuild.exe (PID: 3760)
      • MarsStealer8_cracked_by_LLCPPC.exe (PID: 900)

    • Reads the computer name

      • MarsStealer8_cracked_by_LLCPPC.exe (PID: 3268)
      • MarsStealer_Menu.exe (PID: 6840)
      • oso.exe (PID: 5124)
      • regasm.exe (PID: 5036)
      • MarsStealer_Menu.exe (PID: 6800)
      • MSBuild.exe (PID: 2660)
      • ctfmom.exe (PID: 6656)
      • MarsStealer_Menu.exe (PID: 7128)
      • regasm.exe (PID: 632)
      • oso.exe (PID: 496)
      • MSBuild.exe (PID: 3760)

    • Checks proxy server information

      • MarsStealer8_cracked_by_LLCPPC.exe (PID: 3268)
      • regasm.exe (PID: 5036)
      • regasm.exe (PID: 632)

    • Manual execution by a user

      • MarsStealer_Menu.exe (PID: 6840)
      • MarsStealer8_cracked_by_LLCPPC.exe (PID: 3268)
      • MarsStealer_Menu.exe (PID: 7128)
      • MarsStealer_Menu.exe (PID: 7500)
      • msedge.exe (PID: 6592)
      • MarsStealer8_cracked_by_LLCPPC.exe (PID: 900)
      • MarsStealer8_cracked_by_LLCPPC.exe (PID: 8092)
      • MarsStealer8_cracked_by_LLCPPC.exe (PID: 4428)
      • Builded.exe (PID: 4528)
      • Builded.exe (PID: 8012)

    • Reads the machine GUID from the registry

      • MarsStealer_Menu.exe (PID: 6840)
      • MSBuild.exe (PID: 2660)
      • regasm.exe (PID: 5036)
      • oso.exe (PID: 5124)
      • ctfmom.exe (PID: 6656)
      • MarsStealer_Menu.exe (PID: 7128)
      • oso.exe (PID: 496)
      • regasm.exe (PID: 632)
      • MSBuild.exe (PID: 3760)

    • Creates files or folders in the user directory

      • MarsStealer_Menu.exe (PID: 6840)
      • regasm.exe (PID: 5036)
      • oso.exe (PID: 5124)
      • WerFault.exe (PID: 5720)
      • MarsStealer_Menu.exe (PID: 7128)
      • WerFault.exe (PID: 1132)

    • Process checks computer location settings

      • MarsStealer_Menu.exe (PID: 6840)
      • oso.exe (PID: 5124)
      • MarsStealer_Menu.exe (PID: 7128)

    • Create files in a temporary directory

      • MarsStealer_Menu.exe (PID: 6840)
      • oso.exe (PID: 5124)
      • oso.exe (PID: 496)

    • Launch of the file from Startup directory

      • regasm.exe (PID: 5036)

    • Launch of the file from Registry key

      • regasm.exe (PID: 5036)
      • regasm.exe (PID: 632)

    • Reads Environment values

      • regasm.exe (PID: 5036)
      • regasm.exe (PID: 632)

    • Reads the software policy settings

      • regasm.exe (PID: 5036)
      • slui.exe (PID: 5324)
      • regasm.exe (PID: 632)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 1128)
      • powershell.exe (PID: 1568)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 1128)
      • powershell.exe (PID: 1568)

    • Disables trace logs

      • regasm.exe (PID: 5036)
      • regasm.exe (PID: 632)

    • Confuser has been detected (YARA)

      • regasm.exe (PID: 5036)

    • Attempting to use instant messaging service

      • regasm.exe (PID: 632)

    • Application launched itself

      • msedge.exe (PID: 6592)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
199
Monitored processes
57
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe rundll32.exe no specs #ARKEI marsstealer8_cracked_by_llcppc.exe marsstealer_menu.exe powershell.exe no specs conhost.exe no specs oso.exe regasm.exe marsstealer_menu.exe msbuild.exe no specs werfault.exe no specs ctfmom.exe no specs slui.exe no specs marsstealer_menu.exe powershell.exe no specs conhost.exe no specs oso.exe no specs regasm.exe werfault.exe no specs msbuild.exe no specs marsstealer8_cracked_by_llcppc.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs marsstealer_menu.exe powershell.exe no specs conhost.exe no specs oso.exe no specs werfault.exe no specs marsstealer8_cracked_by_llcppc.exe marsstealer8_cracked_by_llcppc.exe no specs werfault.exe no specs msbuild.exe no specs builded.exe no specs builded.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
456"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3480 --field-trial-handle=2404,i,2662976188560323741,8817316280039217123,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
496"C:\Users\admin\oso.exe" C:\Users\admin\oso.exe—MarsStealer_Menu.exe
User:
admin
Company:
RBSoft
Integrity Level:
MEDIUM
Description:
AutoUpdaterTest
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\oso.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
632"C:\Users\admin\AppData\Local\regasm.exe" C:\Users\admin\AppData\Local\regasm.exe
MarsStealer_Menu.exe
User:
admin
Integrity Level:
MEDIUM
Description:
ctfmon
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
900"C:\Users\admin\Desktop\Mars Stealer 8 cracked\MarsStealer8_cracked_by_LLCPPC.exe" C:\Users\admin\Desktop\Mars Stealer 8 cracked\MarsStealer8_cracked_by_LLCPPC.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\mars stealer 8 cracked\marsstealer8_cracked_by_llcppc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\advapi32.dll
1128"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHgAaQB3ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHkAdQByACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAeQBzACMAPgA="C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—MarsStealer_Menu.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1132C:\WINDOWS\system32\WerFault.exe -u -p 7128 -s 1516C:\Windows\System32\WerFault.exe—MarsStealer_Menu.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
1568"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHgAaQB3ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHkAdQByACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAeQBzACMAPgA="C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—MarsStealer_Menu.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
2392"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2400 --field-trial-handle=2404,i,2662976188560323741,8817316280039217123,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2568"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Mars_Stealer_8_cracked.rarC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2660"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe—oso.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
39 196
Read events
39 144
Write events
52
Delete events
0

Modification events

(PID) Process:(2568) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(2568) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(2568) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2568) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Mars_Stealer_8_cracked.rar
(PID) Process:(2568) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2568) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2568) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2568) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2568) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Comment
Operation:writeName:LeftBorder
Value:
472
(PID) Process:(2568) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
Executable files
10
Suspicious files
55
Text files
358
Unknown types
34

Dropped files

PID
Process
Filename
Type
2568WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2568.1404\Mars Stealer 8 cracked\Panel\instruction.html —
MD5:—
SHA256:—
2568WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2568.1404\Mars Stealer 8 cracked\Panel\mars.sqltext
MD5:A2A91096354B27217A2E37113A137F72
SHA256:48C9360BE86BA73B0852DD4FAFCE067A2A9B011705DC28BC8B3F6C97AB280A95
2568WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2568.1404\Mars Stealer 8 cracked\Panel\plugins_manual.txttext
MD5:FDC3D90112A72CAEB83C0AA9B38E89BD
SHA256:D8ADF295702FB08EB32020DE7B156B3DCD2C49992AB18D4776556A6566256781
2568WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2568.1404\Mars Stealer 8 cracked\Panel\grab_manual.txttext
MD5:9CFDD86059CAFBA662B5C8AB902D28F4
SHA256:6AD2E1DB91903F669DC85461970D45370E2F00515EEE1A9101576A7E95B505CD
2568WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2568.1404\Mars Stealer 8 cracked\Panel\manual_gate.txttext
MD5:17E51AF0B084BF87809BC7E64357B5D9
SHA256:DECB0A810E163A019BB56BED36F89F01C49A5349FA7F71E0F5AA12F8104F4A38
2568WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2568.1404\Mars Stealer 8 cracked\Panel\www\guest\header.phptext
MD5:347F292FB6E6FE1EB1C57701FC3518EA
SHA256:6402C6C9531DDB3C5E1461F5FD3DDA927E81BBE39A476281675ABDF3F8A996C1
2568WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2568.1404\Mars Stealer 8 cracked\Panel\www\guest\assets\js\jquery.min.jss
MD5:DC5E7F18C8D36AC1D3D4753A87C98D0A
SHA256:F7F6A5894F1D19DDAD6FA392B2ECE2C5E578CBF7DA4EA805B6885EB6985B6E3D
2568WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2568.1404\Mars Stealer 8 cracked\Panel\www\guest\assets\js\jquery.analytics_dashboard.init.jstext
MD5:5D1374DA2B16C4F927F64010FFEC2F67
SHA256:5572BA9D951867A1083ADF7A5434A4AD51E3DFC50C4830CADAE1C1C52702A8BD
2568WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2568.1404\Mars Stealer 8 cracked\Panel\manul_panel.htmlhtml
MD5:4DA0595D97FFFABEA58FFDB6CC493353
SHA256:D6D3B257E3E35D9088A4051F612605C4459BE0E7D5C27E687B82275331082FCF
2568WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2568.1404\Mars Stealer 8 cracked\Panel\www\panel\assets\.DS_Storeds_store
MD5:C08BF38D05A1B5187E055EBEDBDAAF2E
SHA256:AAAD61391F131047CDD887BE195420C1591777AFA383CD14F30A2EB2C08401CF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
35
DNS requests
37
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5796
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6300
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6300
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6112
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5796
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5796
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6300
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
api.telegram.org
  • 149.154.167.220
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.19
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
5036
regasm.exe
Misc activity
ET HUNTING Telegram API Certificate Observed
5036
regasm.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
632
regasm.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
632
regasm.exe
Misc activity
ET HUNTING Telegram API Certificate Observed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Mars_Stealer_8_cracked.rar