SYMBOLCOMMON_NAMEaka. SYNONYMS
win.mars_stealer (Back to overview)

Mars Stealer


3xp0rt describes Mars Stealer as an improved successor of Oski Stealer, supporting stealing from current browsers and targeting crypto currencies and 2FA plugins.

References
2022-12-29ThreatMonThreatMon Malware Research Team
@online{team:20221229:mars:5cb748d, author = {ThreatMon Malware Research Team}, title = {{Mars Stealer Analysis}}, date = {2022-12-29}, organization = {ThreatMon}, url = {https://threatmon.io/mars-stealer-malware-analysis-threatmon/}, language = {English}, urldate = {2023-02-17} } Mars Stealer Analysis
Mars Stealer
2022-12-18ZAYOTEMÖmer Faruk Kayıkcı, Nisanur Çıldız, Meryem Ahıskalı
@online{kaykc:20221218:mars:dc1db9a, author = {Ömer Faruk Kayıkcı and Nisanur Çıldız and Meryem Ahıskalı}, title = {{Mars Stealer Technical Analysis Report}}, date = {2022-12-18}, organization = {ZAYOTEM}, url = {https://drive.google.com/file/d/14cmYxzowVLyuiS5qDGOKzgI2_vak2Fve/view}, language = {English}, urldate = {2022-12-20} } Mars Stealer Technical Analysis Report
Mars Stealer
2022-09-15SekoiaThreat & Detection Research Team
@online{team:20220915:privateloader:d88c7b2, author = {Threat & Detection Research Team}, title = {{PrivateLoader: the loader of the prevalent ruzki PPI service}}, date = {2022-09-15}, organization = {Sekoia}, url = {https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/}, language = {English}, urldate = {2022-09-19} } PrivateLoader: the loader of the prevalent ruzki PPI service
Agent Tesla Coinminer DanaBot DCRat Eternity Stealer Glupteba Mars Stealer NetSupportManager RAT Nymaim Nymaim2 Phoenix Keylogger PrivateLoader Raccoon RedLine Stealer SmokeLoader Socelars STOP Vidar YTStealer
2022-08-02Recorded FutureInsikt Group
@techreport{group:20220802:initial:5caddb5, author = {Insikt Group}, title = {{Initial Access Brokers Are Key to Rise in Ransomware Attacks}}, date = {2022-08-02}, institution = {Recorded Future}, url = {https://go.recordedfuture.com/hubfs/reports/cta-2022-0802.pdf}, language = {English}, urldate = {2022-08-05} } Initial Access Brokers Are Key to Rise in Ransomware Attacks
Azorult BlackMatter Conti Mars Stealer Raccoon RedLine Stealer Taurus Stealer Vidar
2022-08-02cybleCyble Research Labs
@online{labs:20220802:fake:9770cab, author = {Cyble Research Labs}, title = {{Fake Atomic Wallet Website Distributing Mars Stealer}}, date = {2022-08-02}, organization = {cyble}, url = {https://blog.cyble.com/2022/08/02/fake-atomic-wallet-website-distributing-mars-stealer/}, language = {English}, urldate = {2022-08-08} } Fake Atomic Wallet Website Distributing Mars Stealer
Mars Stealer
2022-07-13KELAKELA Cyber Intelligence Center
@online{center:20220713:next:b2e43e4, author = {KELA Cyber Intelligence Center}, title = {{The Next Generation of Info Stealers}}, date = {2022-07-13}, organization = {KELA}, url = {https://ke-la.com/information-stealers-a-new-landscape/}, language = {English}, urldate = {2022-07-18} } The Next Generation of Info Stealers
Arkei Stealer Azorult BlackGuard Eternity Stealer Ginzo Stealer Mars Stealer MetaStealer Raccoon RedLine Stealer Vidar
2022-05-21Github (x-junior)Mohamed Ashraf
@online{ashraf:20220521:deep:0e3523b, author = {Mohamed Ashraf}, title = {{Deep Analysis of Mars Stealer}}, date = {2022-05-21}, organization = {Github (x-junior)}, url = {https://x-junior.github.io/malware%20analysis/MarsStealer/}, language = {English}, urldate = {2022-05-23} } Deep Analysis of Mars Stealer
Mars Stealer
2022-05-18eSentireeSentire Threat Response Unit (TRU)
@online{tru:20220518:esentire:662b9d9, author = {eSentire Threat Response Unit (TRU)}, title = {{eSentire Threat Intelligence Malware Analysis: Mars Stealer}}, date = {2022-05-18}, organization = {eSentire}, url = {https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-mars-stealer}, language = {English}, urldate = {2022-05-24} } eSentire Threat Intelligence Malware Analysis: Mars Stealer
Mars Stealer
2022-05-17Microsoft SecurityBerman Enconado, Laurie Kirk
@online{enconado:20220517:in:c234e4d, author = {Berman Enconado and Laurie Kirk}, title = {{In hot pursuit of ‘cryware’: Defending hot wallets from attacks}}, date = {2022-05-17}, organization = {Microsoft Security}, url = {https://www.microsoft.com/security/blog/2022/05/17/in-hot-pursuit-of-cryware-defending-hot-wallets-from-attacks/}, language = {English}, urldate = {2022-05-25} } In hot pursuit of ‘cryware’: Defending hot wallets from attacks
Mars Stealer RedLine Stealer
2022-04-20InfoSec InstitutePedro Tavares
@online{tavares:20220420:mars:6bb8872, author = {Pedro Tavares}, title = {{Mars Stealer malware analysis}}, date = {2022-04-20}, organization = {InfoSec Institute}, url = {https://resources.infosecinstitute.com/topic/mars-stealer-malware-analysis/}, language = {English}, urldate = {2022-07-25} } Mars Stealer malware analysis
Mars Stealer
2022-04-11eSentireeSentire Threat Response Unit (TRU)
@online{tru:20220411:fake:e57b0f2, author = {eSentire Threat Response Unit (TRU)}, title = {{Fake Chrome Setup Leads to NetSupportManager RAT and Mars Stealer}}, date = {2022-04-11}, organization = {eSentire}, url = {https://www.esentire.com/blog/fake-chrome-setup-leads-to-netsupportmanager-rat-and-mars-stealer}, language = {English}, urldate = {2022-05-24} } Fake Chrome Setup Leads to NetSupportManager RAT and Mars Stealer
Mars Stealer NetSupportManager RAT
2022-04-10Bleeping ComputerBill Toulas
@online{toulas:20220410:new:1241933, author = {Bill Toulas}, title = {{New Meta information stealer distributed in malspam campaign}}, date = {2022-04-10}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/new-meta-information-stealer-distributed-in-malspam-campaign/}, language = {English}, urldate = {2022-05-05} } New Meta information stealer distributed in malspam campaign
BlackGuard Mars Stealer Raccoon
2022-04-07SekoiaThreat & Detection Research Team
@online{team:20220407:mars:9a72e1f, author = {Threat & Detection Research Team}, title = {{Mars, a red-hot information stealer}}, date = {2022-04-07}, organization = {Sekoia}, url = {https://blog.sekoia.io/mars-a-red-hot-information-stealer/}, language = {English}, urldate = {2022-04-08} } Mars, a red-hot information stealer
Mars Stealer
2022-04-05Malwarebytes LabsAnkur Saini, Hossein Jazi, Jérôme Segura
@online{saini:20220405:colibri:ee97c2e, author = {Ankur Saini and Hossein Jazi and Jérôme Segura}, title = {{Colibri Loader combines Task Scheduler and PowerShell in clever persistence technique}}, date = {2022-04-05}, organization = {Malwarebytes Labs}, url = {https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/}, language = {English}, urldate = {2022-06-09} } Colibri Loader combines Task Scheduler and PowerShell in clever persistence technique
Colibri Loader Mars Stealer
2022-03-30Cert-UACert-UA
@online{certua:20220330:mass:5bc04fd, author = {Cert-UA}, title = {{Mass distribution of the MarsStealer malware among citizens of Ukraine and domestic organizations (CERT-UA#4315)}}, date = {2022-03-30}, organization = {Cert-UA}, url = {https://cert.gov.ua/article/38606}, language = {Ukrainian}, urldate = {2022-04-04} } Mass distribution of the MarsStealer malware among citizens of Ukraine and domestic organizations (CERT-UA#4315)
Mars Stealer
2022-03-29MorphisecArnold Osipov
@online{osipov:20220329:exclusive:37a9d8b, author = {Arnold Osipov}, title = {{Exclusive Threat Research: Mars (Stealer) Attacks!}}, date = {2022-03-29}, organization = {Morphisec}, url = {https://blog.morphisec.com/threat-research-mars-stealer}, language = {English}, urldate = {2022-03-31} } Exclusive Threat Research: Mars (Stealer) Attacks!
Mars Stealer
2022-03-23InfoSec Handlers Diary BlogBrad Duncan
@online{duncan:20220323:arkei:f9a44a4, author = {Brad Duncan}, title = {{Arkei Variants: From Vidar to Mars Stealer}}, date = {2022-03-23}, organization = {InfoSec Handlers Diary Blog}, url = {https://isc.sans.edu/diary/Arkei+Variants%3A+From+Vidar+to+Mars+Stealer/28468}, language = {English}, urldate = {2023-04-25} } Arkei Variants: From Vidar to Mars Stealer
Arkei Stealer Mars Stealer Oski Stealer Vidar
2022-03-23InfoSec Handlers Diary BlogBrad Duncan
@online{duncan:20220323:arkei:b2a08f5, author = {Brad Duncan}, title = {{Arkei Variants: From Vidar to Mars Stealer}}, date = {2022-03-23}, organization = {InfoSec Handlers Diary Blog}, url = {https://isc.sans.edu/diary/rss/28468}, language = {English}, urldate = {2022-03-25} } Arkei Variants: From Vidar to Mars Stealer
Arkei Stealer Mars Stealer Vidar
2022-02-22CyberIntShmuel Gihon
@online{gihon:20220222:like:5154c54, author = {Shmuel Gihon}, title = {{Like Father Like Son? New Mars Stealer}}, date = {2022-02-22}, organization = {CyberInt}, url = {https://cyberint.com/blog/research/mars-stealer/}, language = {English}, urldate = {2022-03-23} } Like Father Like Son? New Mars Stealer
Mars Stealer Oski Stealer
2022-02-013xp0rt3xp0rt
@online{3xp0rt:20220201:mars:3ff37ea, author = {3xp0rt}, title = {{Mars Stealer: Oski refactoring}}, date = {2022-02-01}, organization = {3xp0rt}, url = {https://3xp0rt.com/posts/mars-stealer}, language = {English}, urldate = {2022-04-15} } Mars Stealer: Oski refactoring
Mars Stealer Oski Stealer
Yara Rules
[TLP:WHITE] win_mars_stealer_auto (20230407 | Detects win.mars_stealer.)
rule win_mars_stealer_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-03-28"
        version = "1"
        description = "Detects win.mars_stealer."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mars_stealer"
        malpedia_rule_date = "20230328"
        malpedia_hash = "9d2d75cef573c1c2d861f5197df8f563b05a305d"
        malpedia_version = "20230407"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 52 e8???????? 6a00 6a00 6a00 6a01 }
            // n = 6, score = 100
            //   52                   | push                edx
            //   e8????????           |                     
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   6a01                 | push                1

        $sequence_1 = { 50 ff15???????? 034518 038558e6ffff 50 e8???????? }
            // n = 6, score = 100
            //   50                   | push                eax
            //   ff15????????         |                     
            //   034518               | add                 eax, dword ptr [ebp + 0x18]
            //   038558e6ffff         | add                 eax, dword ptr [ebp - 0x19a8]
            //   50                   | push                eax
            //   e8????????           |                     

        $sequence_2 = { 8d4df4 51 ff15???????? 5f 5e 8be5 }
            // n = 6, score = 100
            //   8d4df4               | lea                 ecx, [ebp - 0xc]
            //   51                   | push                ecx
            //   ff15????????         |                     
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   8be5                 | mov                 esp, ebp

        $sequence_3 = { 6800010000 8d8de8feffff 51 6aff 8b953cfbffff }
            // n = 5, score = 100
            //   6800010000           | push                0x100
            //   8d8de8feffff         | lea                 ecx, [ebp - 0x118]
            //   51                   | push                ecx
            //   6aff                 | push                -1
            //   8b953cfbffff         | mov                 edx, dword ptr [ebp - 0x4c4]

        $sequence_4 = { 6a00 68???????? ff15???????? 8945f0 837df000 0f85fd040000 }
            // n = 6, score = 100
            //   6a00                 | push                0
            //   68????????           |                     
            //   ff15????????         |                     
            //   8945f0               | mov                 dword ptr [ebp - 0x10], eax
            //   837df000             | cmp                 dword ptr [ebp - 0x10], 0
            //   0f85fd040000         | jne                 0x503

        $sequence_5 = { ff15???????? a3???????? 833d????????00 0f8455010000 }
            // n = 4, score = 100
            //   ff15????????         |                     
            //   a3????????           |                     
            //   833d????????00       |                     
            //   0f8455010000         | je                  0x15b

        $sequence_6 = { 55 8bec b8b8160000 e8???????? 6888130000 8d8558eaffff 50 }
            // n = 7, score = 100
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   b8b8160000           | mov                 eax, 0x16b8
            //   e8????????           |                     
            //   6888130000           | push                0x1388
            //   8d8558eaffff         | lea                 eax, [ebp - 0x15a8]
            //   50                   | push                eax

        $sequence_7 = { 2b4d08 c681407c410000 8b550c 8955f8 }
            // n = 4, score = 100
            //   2b4d08               | sub                 ecx, dword ptr [ebp + 8]
            //   c681407c410000       | mov                 byte ptr [ecx + 0x417c40], 0
            //   8b550c               | mov                 edx, dword ptr [ebp + 0xc]
            //   8955f8               | mov                 dword ptr [ebp - 8], edx

        $sequence_8 = { 837df820 0f8d61030000 6804010000 8d8de8feffff 51 e8???????? }
            // n = 6, score = 100
            //   837df820             | cmp                 dword ptr [ebp - 8], 0x20
            //   0f8d61030000         | jge                 0x367
            //   6804010000           | push                0x104
            //   8d8de8feffff         | lea                 ecx, [ebp - 0x118]
            //   51                   | push                ecx
            //   e8????????           |                     

        $sequence_9 = { e9???????? 6804010000 8d9550e9ffff 52 e8???????? }
            // n = 5, score = 100
            //   e9????????           |                     
            //   6804010000           | push                0x104
            //   8d9550e9ffff         | lea                 edx, [ebp - 0x16b0]
            //   52                   | push                edx
            //   e8????????           |                     

    condition:
        7 of them and filesize < 219136
}
Download all Yara Rules