HashDeger
SHA25695b229600f28adfbe56fc09cd8a8ff88baf261329999f681613e5c951907d451
MD5a9238e825430fcbd071dfb83a549db7f
Boyut976408 bytes

MarsStealer C2

C2: code.visualstudio.com

Port: 443

Tehdit Degerlendirmesi

MarsStealer: C2: code.visualstudio.com. KEYDAL kSentinel.

MarsStealer — Malware Profili

MarsStealer, 2022 de ortaya cikan C++ tabanli infostealer ailesidir. RC2/XOR C2, tarayici, kripto cuzdan, Discord, Steam, 2FA token calma. AZORult varisi.

Malware Tipi
Infostealer
Programlama Dili
C
C2 Protokolü
HTTPS
Hedef Sistemler
Windows
Diğer Adlar (AKA)
Oski Stealer variant, Mars 2.9

Teknik Detaylar

Mars Stealer is a C-based information stealer sold on underground forums since 2021. Successor to Oski Stealer (abandoned after developer arrest in 2020). Targets 40+ browser extensions including MetaMask, Coinbase Wallet, Ledger Live, Atomic, Exodus. Steals: browser passwords/cookies/autofill, screenshots, system info (hardware ID, username, OS), FileZilla/WinSCP credentials, Telegram sessions. Small footprint (~95KB), HTTP POST for exfiltration with base64+XOR encoding. Uses SQLite to parse browser credential stores. Delivered via cracked software downloads, fake Telegram/Discord bots, SEO poisoning. Web panel: SQLite backend, panel sold alongside stealer for ~$140.

Atıf / Tehdit Aktörü

Unknown (sold on XSS/Exploit.in forums)

Yetenekler ve Davranış

Tarayıcı Kimlik Bilgileri
Çerez Hırsızlığı
Kripto Cüzdan Çalma
Sistem Bilgisi
Ekran Görüntüsü
FTP/SSH İstemci Şifreleri
E-posta İstemcisi Çalma
Veri Sızıntısı

IOC Listesi (2 gösterge)

IOC — MarsStealer
# SHA256 95b229600f28adfbe56fc09cd8a8ff88baf261329999f681613e5c951907d451 # MD5 a9238e825430fcbd071dfb83a549db7f
TürDeğerNot
sha256 95b229600f28adfbe56fc09cd8a8ff88baf261329999f681613e5c951907d451 MarsStealer
md5 a9238e825430fcbd071dfb83a549db7f MarsStealer
MarsStealer — Tam Profiline Git →
Etiketler
mars-stealermalwareanalizstatik