Mars Stealer (Malware Family)

SYMBOL	COMMON_NAME	aka. SYNONYMS

win.mars_stealer (Back to overview)

Mars Stealer

3xp0rt describes Mars Stealer as an improved successor of Oski Stealer, supporting stealing from current browsers and targeting crypto currencies and 2FA plugins.

References

2022-12-29 ⋅ ThreatMon ⋅ ThreatMon Malware Research Team
Mars Stealer Analysis
Mars Stealer

2022-12-18 ⋅ ZAYOTEM ⋅ Ömer Faruk Kayıkcı, Nisanur Çıldız, Meryem Ahıskalı
Mars Stealer Technical Analysis Report
Mars Stealer

2022-09-15 ⋅ Sekoia ⋅ Threat & Detection Research Team
PrivateLoader: the loader of the prevalent ruzki PPI service
Agent Tesla Coinminer DanaBot DCRat Eternity Stealer Glupteba Mars Stealer NetSupportManager RAT Nymaim Nymaim2 Phoenix Keylogger PrivateLoader Raccoon RedLine Stealer SmokeLoader Socelars STOP Vidar YTStealer

2022-08-02 ⋅ Recorded Future ⋅ Insikt Group
Initial Access Brokers Are Key to Rise in Ransomware Attacks
Azorult BlackMatter Conti Mars Stealer Raccoon RedLine Stealer Taurus Stealer Vidar

2022-08-02 ⋅ cyble ⋅ Cyble Research Labs
Fake Atomic Wallet Website Distributing Mars Stealer
Mars Stealer

2022-07-13 ⋅ KELA ⋅ KELA Cyber Intelligence Center
The Next Generation of Info Stealers
Arkei Stealer Azorult BlackGuard Eternity Stealer Ginzo Stealer Mars Stealer MetaStealer Raccoon RedLine Stealer Vidar

2022-05-21 ⋅ Github (x-junior) ⋅ Mohamed Ashraf
Deep Analysis of Mars Stealer
Mars Stealer

2022-05-18 ⋅ eSentire ⋅ eSentire Threat Response Unit (TRU)
eSentire Threat Intelligence Malware Analysis: Mars Stealer
Mars Stealer

2022-05-17 ⋅ Microsoft Security ⋅ Berman Enconado, Laurie Kirk
In hot pursuit of ‘cryware’: Defending hot wallets from attacks
Mars Stealer RedLine Stealer

2022-04-20 ⋅ InfoSec Institute ⋅ Pedro Tavares
Mars Stealer malware analysis
Mars Stealer

2022-04-11 ⋅ eSentire ⋅ eSentire Threat Response Unit (TRU)
Fake Chrome Setup Leads to NetSupportManager RAT and Mars Stealer
Mars Stealer NetSupportManager RAT

2022-04-10 ⋅ Bleeping Computer ⋅ Bill Toulas
New Meta information stealer distributed in malspam campaign
BlackGuard Mars Stealer Raccoon

2022-04-07 ⋅ Sekoia ⋅ Threat & Detection Research Team
Mars, a red-hot information stealer
Mars Stealer

2022-04-05 ⋅ Malwarebytes Labs ⋅ Ankur Saini, Hossein Jazi, Jérôme Segura
Colibri Loader combines Task Scheduler and PowerShell in clever persistence technique
Colibri Loader Mars Stealer

2022-03-30 ⋅ Cert-UA ⋅ Cert-UA
Mass distribution of the MarsStealer malware among citizens of Ukraine and domestic organizations (CERT-UA#4315)
Mars Stealer

2022-03-29 ⋅ Morphisec ⋅ Arnold Osipov
Exclusive Threat Research: Mars (Stealer) Attacks!
Mars Stealer

2022-03-23 ⋅ InfoSec Handlers Diary Blog ⋅ Brad Duncan
Arkei Variants: From Vidar to Mars Stealer
Arkei Stealer Mars Stealer Oski Stealer Vidar

2022-03-23 ⋅ InfoSec Handlers Diary Blog ⋅ Brad Duncan
Arkei Variants: From Vidar to Mars Stealer
Arkei Stealer Mars Stealer Vidar

2022-02-22 ⋅ CyberInt ⋅ Shmuel Gihon
Like Father Like Son? New Mars Stealer
Mars Stealer Oski Stealer

2022-02-01 ⋅ 3xp0rt ⋅ 3xp0rt
Mars Stealer: Oski refactoring
Mars Stealer Oski Stealer

Yara Rules

[TLP:WHITE] win_mars_stealer_auto (20230715 | Detects win.mars_stealer.)

rule win_mars_stealer_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-07-11"
        version = "1"
        description = "Detects win.mars_stealer."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mars_stealer"
        malpedia_rule_date = "20230705"
        malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
        malpedia_version = "20230715"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8b15???????? 52 e8???????? 83c40c e8???????? }
            // n = 5, score = 100
            //   8b15????????         |                     
            //   52                   | push                edx
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc
            //   e8????????           |                     

        $sequence_1 = { e8???????? 83c40c 6888130000 8d95f0d8ffff 52 e8???????? }
            // n = 6, score = 100
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc
            //   6888130000           | push                0x1388
            //   8d95f0d8ffff         | lea                 edx, [ebp - 0x2710]
            //   52                   | push                edx
            //   e8????????           |                     

        $sequence_2 = { 8b45f8 c7404800000000 8b4df8 c7417c00000000 837d0800 0f848f000000 8b5508 }
            // n = 7, score = 100
            //   8b45f8               | mov                 eax, dword ptr [ebp - 8]
            //   c7404800000000       | mov                 dword ptr [eax + 0x48], 0
            //   8b4df8               | mov                 ecx, dword ptr [ebp - 8]
            //   c7417c00000000       | mov                 dword ptr [ecx + 0x7c], 0
            //   837d0800             | cmp                 dword ptr [ebp + 8], 0
            //   0f848f000000         | je                  0x95
            //   8b5508               | mov                 edx, dword ptr [ebp + 8]

        $sequence_3 = { ff15???????? 83c404 8945e8 8b55e8 8955fc 8b4508 8945e4 }
            // n = 7, score = 100
            //   ff15????????         |                     
            //   83c404               | add                 esp, 4
            //   8945e8               | mov                 dword ptr [ebp - 0x18], eax
            //   8b55e8               | mov                 edx, dword ptr [ebp - 0x18]
            //   8955fc               | mov                 dword ptr [ebp - 4], edx
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8945e4               | mov                 dword ptr [ebp - 0x1c], eax

        $sequence_4 = { 8b148d68654100 8955fc 837dfc00 7427 8b45f4 8b4d08 8b55ec }
            // n = 7, score = 100
            //   8b148d68654100       | mov                 edx, dword ptr [ecx*4 + 0x416568]
            //   8955fc               | mov                 dword ptr [ebp - 4], edx
            //   837dfc00             | cmp                 dword ptr [ebp - 4], 0
            //   7427                 | je                  0x29
            //   8b45f4               | mov                 eax, dword ptr [ebp - 0xc]
            //   8b4d08               | mov                 ecx, dword ptr [ebp + 8]
            //   8b55ec               | mov                 edx, dword ptr [ebp - 0x14]

        $sequence_5 = { 55 8bec c705????????ac304100 c705????????c4304100 c705????????d4304100 c705????????e4304100 }
            // n = 6, score = 100
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   c705????????ac304100     |     
            //   c705????????c4304100     |     
            //   c705????????d4304100     |     
            //   c705????????e4304100     |     

        $sequence_6 = { 8bb540fbffff 33c0 f3a7 0f851c020000 6a00 }
            // n = 5, score = 100
            //   8bb540fbffff         | mov                 esi, dword ptr [ebp - 0x4c0]
            //   33c0                 | xor                 eax, eax
            //   f3a7                 | repe cmpsd          dword ptr [esi], dword ptr es:[edi]
            //   0f851c020000         | jne                 0x222
            //   6a00                 | push                0

        $sequence_7 = { a1???????? 50 8b0d???????? 51 ff15???????? 68???????? 8b15???????? }
            // n = 7, score = 100
            //   a1????????           |                     
            //   50                   | push                eax
            //   8b0d????????         |                     
            //   51                   | push                ecx
            //   ff15????????         |                     
            //   68????????           |                     
            //   8b15????????         |                     

        $sequence_8 = { c745dc00000000 c745e000000000 c745e400000000 8d55c4 52 ff15???????? 6a3c }
            // n = 7, score = 100
            //   c745dc00000000       | mov                 dword ptr [ebp - 0x24], 0
            //   c745e000000000       | mov                 dword ptr [ebp - 0x20], 0
            //   c745e400000000       | mov                 dword ptr [ebp - 0x1c], 0
            //   8d55c4               | lea                 edx, [ebp - 0x3c]
            //   52                   | push                edx
            //   ff15????????         |                     
            //   6a3c                 | push                0x3c

        $sequence_9 = { e9???????? 6804010000 8d9550e9ffff 52 e8???????? }
            // n = 5, score = 100
            //   e9????????           |                     
            //   6804010000           | push                0x104
            //   8d9550e9ffff         | lea                 edx, [ebp - 0x16b0]
            //   52                   | push                edx
            //   e8????????           |                     

    condition:
        7 of them and filesize < 219136
}

Download all Yara Rules

Mars Stealer Propose Change

References

Yara Rules

Mars Stealer