MalwareUsed by 1 actor

MARSSTEALER

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

UAC-0041

У разі відкриття архіву та запуску EXE-файлу, комп'ютер буде уражено шкідливою програмою, яку, за сукупністю ознак (незважачи на деякі відмінності), класифіковано як MarsStealer. MarsStelaer - шкідлива програма-стілер, розроблена з використанням мов програмування C/ASM.

via cert uacert.gov.ua

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques

T1566PhishingEvidence1

CERT-UA received information about mass distribution of emails with the subject "Нова програма для запису в журналi." The email text impersonates the Ministry of Education and Science of Ukraine and contains a link to a "program" plus an archive password.

T1566.001Spearphishing AttachmentEvidence1

...отримання несанкціонованого доступу до комп'ютерів бухгалтерів... наведено декілька прикладів ланцюгів інфікування... (LNK-файлу)... (RAR-архіву з паролем та VBS/BAT файлів) ... Документи.zip / Документи (СУД).rar / Платіжні документи.zip / ... .vbs / ... .bat / Документи.pdf.lnk

T1566.002Spearphishing LinkEvidence1

The email contains a message allegedly from the Ministry of Education and Science of Ukraine regarding "electronic educational journals", as well as a link to the "program" and a password for the archive.

Execution

2 techniques

T1059.005Visual BasicEvidence1

MarsStelaer - шкідлива програма-стілер, розроблена з використанням мов програмування C/ASM.

T1204User ExecutionEvidence1

У разі відкриття архіву та запуску EXE-файлу, комп'ютер буде уражено шкідливою програмою

Credential Access

2 techniques

T1555.003Credentials from Web BrowsersEvidence1

Основний функціонал - ... викрадення аутентифікаційних даних з Інтернет-браузерів

T1649Steal or Forge Authentication CertificatesEvidence1

Основний функціонал - ... викрадення аутентифікаційних даних ... плагінів крипто-гаманців, програм багатофакторної аутентифікації

Collection

3 techniques

T1005Data from Local SystemEvidence1

Основний функціонал - збір інформації про комп'ютер ... викрадення файлів

T1113Screen CaptureEvidence1

Основний функціонал - ... а також завантаження і запуск виконуваних файлів і виготовлення знімку екрану.

T1560Archive Collected DataEvidence1

The email provides ... a password for the archive. If the archive is opened and the EXE file launched, the computer will be infected.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

Network indicators include download URLs such as hXXps://drive.google[.]com/... and hXXps://api.dev-com[.]sc/files_1/v_5.1.9.exe and .../v_5.1.9.zip.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cert uaNews

Mar 30, 2022

CERT-UA

Information-stealing malware written in C/ASM that collects system information, steals authentication data from web browsers, crypto-wallet plugins, and multi-factor authentication applications, steals files, can download and execute additional files, and take screenshots.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

MARSSTEALER

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

UAC-0041

via cert uacert.gov.ua

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques

T1566PhishingEvidence1

T1566.001Spearphishing AttachmentEvidence1

T1566.002Spearphishing LinkEvidence1

Execution

2 techniques

T1059.005Visual BasicEvidence1

MarsStelaer - шкідлива програма-стілер, розроблена з використанням мов програмування C/ASM.

T1204User ExecutionEvidence1

У разі відкриття архіву та запуску EXE-файлу, комп'ютер буде уражено шкідливою програмою

Credential Access

2 techniques

T1555.003Credentials from Web BrowsersEvidence1

Основний функціонал - ... викрадення аутентифікаційних даних з Інтернет-браузерів

T1649Steal or Forge Authentication CertificatesEvidence1

Collection

3 techniques

T1005Data from Local SystemEvidence1

Основний функціонал - збір інформації про комп'ютер ... викрадення файлів

T1113Screen CaptureEvidence1

Основний функціонал - ... а також завантаження і запуск виконуваних файлів і виготовлення знімку екрану.

T1560Archive Collected DataEvidence1

The email provides ... a password for the archive. If the archive is opened and the EXE file launched, the computer will be infected.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

Network indicators include download URLs such as hXXps://drive.google[.]com/... and hXXps://api.dev-com[.]sc/files_1/v_5.1.9.exe and .../v_5.1.9.zip.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cert uaNews

Mar 30, 2022

CERT-UA

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.