MarsStealer - Deep Static Analysis (18c7c5e7)

Hash	Deger
SHA256	18c7c5e7d5146bef12ead85598bf5d2c48ee5e6634d4769221d3e7712809f1ad
MD5	1cde32d54a0f0f2ddad79d7df6a7419f
Boyut	227672 bytes

MarsStealer C2

C2: Tespit edilemedi

Port: 443

Tehdit Degerlendirmesi

MarsStealer: Config tespit edilemedi. KEYDAL kSentinel.

MarsStealer — Malware Profile

MarsStealer, 2022 de ortaya cikan C++ tabanli infostealer ailesidir. RC2/XOR C2, tarayici, kripto cuzdan, Discord, Steam, 2FA token calma. AZORult varisi.

Malware Type

Infostealer

Programming Language

C2 Protocol

HTTPS

Target Systems

Windows

Also Known As (AKA)

Oski Stealer variant, Mars 2.9

Technical Details

Mars Stealer is a C-based information stealer sold on underground forums since 2021. Successor to Oski Stealer (abandoned after developer arrest in 2020). Targets 40+ browser extensions including MetaMask, Coinbase Wallet, Ledger Live, Atomic, Exodus. Steals: browser passwords/cookies/autofill, screenshots, system info (hardware ID, username, OS), FileZilla/WinSCP credentials, Telegram sessions. Small footprint (~95KB), HTTP POST for exfiltration with base64+XOR encoding. Uses SQLite to parse browser credential stores. Delivered via cracked software downloads, fake Telegram/Discord bots, SEO poisoning. Web panel: SQLite backend, panel sold alongside stealer for ~$140.

Attribution / Threat Actor

Unknown (sold on XSS/Exploit.in forums)

Capabilities & Behavior

Tarayıcı Kimlik Bilgileri

Çerez Hırsızlığı

Kripto Cüzdan Çalma

Sistem Bilgisi

Ekran Görüntüsü

FTP/SSH İstemci Şifreleri

E-posta İstemcisi Çalma

Veri Sızıntısı

IOC List (2 indicators)

IOC — MarsStealer

# SHA256
18c7c5e7d5146bef12ead85598bf5d2c48ee5e6634d4769221d3e7712809f1ad 

# MD5
1cde32d54a0f0f2ddad79d7df6a7419f

Type	Value	Note
sha256	18c7c5e7d5146bef12ead85598bf5d2c48ee5e6634d4769221d3e7712809f1ad	MarsStealer
md5	1cde32d54a0f0f2ddad79d7df6a7419f	MarsStealer

MarsStealer — Go to Full Profile →