Loading malware…
Mars Stealer is a Windows information-stealing malware family first advertised on underground cybercrime forums in June 2021. It is a successor to Oski Stealer and belongs to the broader Arkei-derived stealer lineage. Commercially distributed to cybercriminal operators, it targets browser credentials, session cookies, autofill information, browsing history, cryptocurrency wallets, password managers, and two-factor authentication browser extensions. Its collection capabilities also include RDP credentials, certificates, Discord data, screenshots, system information, and attacker-selected files.
Mars Stealer collects sensitive files from browser-based and desktop cryptocurrency wallets, packages stolen information into ZIP archives, and exfiltrates it to command-and-control servers using HTTP POST requests. Observed versions retrieve legitimate supporting DLLs together in a ZIP archive. The malware also supports downloading and executing additional payloads and deleting itself after execution. Anti-analysis features include debugger detection, timing-based sandbox checks, Windows Defender emulation checks, and language-based execution exclusions. An observed deployment used obfuscated AutoIt scripts and a separately loaded Windows native library to inject the stealer into a legitimate process while attempting to evade endpoint monitoring.
Distribution includes cloned software websites, drive-by downloads, cracked software, patches, and key generators. A documented phishing campaign impersonated Atomic Wallet and offered a malicious Windows installer that used batch and PowerShell stages to retrieve Mars Stealer from Discord. It has also been delivered as a secondary payload by PrivateLoader, Colibri Loader, Hancitor, PureCrypter, and an attacker-controlled NetSupport Manager installation. These campaigns target Windows users and cryptocurrency holders, enabling account compromise and cryptocurrency theft through stolen credentials, session data, and wallet secrets.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
In this previous campaign, the bitbucket folder contained additional malwares such as Remcos, Sectop RAT, Lumma Stealer, Mars Stealer, and Darktrack RAT.
Malware advertised in underground forums as Mars Stealer started to appear in 2021.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
Mars Stealer has been delivered as a drive-by download via cloned websites for known software, such as Open Office.
MITRE ATT&CK® Techniques Tactic Technique ID Technique Name Initial Access T1566 Phishing
aNpRAHx.exe (original name: 3uAirPlayer.exe) was used to plant the following AutoIt scripts... The AutoIt scripts were highly obfuscated.
When the user clicks on the “ Download for Windows ” button, it connects to shortened URL “ hxxps://bit[.]ly/3PRDyH8 ” and downloads a Zip file named “ Atomic Wallet.zip “.
The initial access vector occurred when the victim visited a malicious website hosting an ISO image named ChromeSetup.iso... The ISO image contained ChromeSetup.exe, which had an embedded NetSupportManager RAT.
NTDLL.DLL is responsible for injecting Mars Stealer into explorer.exe module during the runtime.
Then, the .bat file executes PowerShell content using AtomicWallet_Setup.bat.exe, which further decodes the base64-encoded content and decrypts it using an AES algorithm that stores a Gzip Compressed stream in the memory.
The NetSupportManager RAT was obfuscated by the attacker as ‘21m_18_033.exe’... another executable was dropped via the remote session on the victim’s machine – consoleappmrss.exe.
NTDLL.DLL is responsible for injecting Mars Stealer into explorer.exe module during the runtime.
Mars Stealer can self-delete itself after successfully exfiltrating the victim’s data... The self-delete command is executed via command line: /c timeout /t 5 & del /f /q "%s" & exit
def deobfuscate(address): ... dp = Dumpulator("mars_stealer.dump", quiet=True) ... out = dp.read_str(dp.regs.ecx) return out ... for s in starting_points: ... print(f'Address { hex ( s ) } : { deobfuscate ( s ) } ' )
For anti-sandboxing, the stealer sleeps for 16000 milliseconds and calls GetTickCount API... If the value is less than 12000, it means that the Sleep function was skipped by the debugger or sandbox, and the sample exits.
The .bat file then copies powershell.exe into the current directory , renames it as AtomicWallet_Setup.bat.exe, and then hides it using the attrib command.
Moreover, in order to bypass the detection by EDR tools, attacker(s) will independently load a copy of NTDLL.DLL.
For anti-debugging purposes, it manually checks the PEB (Process Environment Block) for BeingDebugged flag.
MITRE ATT&CK® Techniques Tactic Technique ID Technique Name ... Credential Access ... T1528 ... Steal Application Access Token
MITRE ATT&CK® Techniques Tactic Technique ID Technique Name ... Credential Access ... T1539 ... Steal Web Session Cookies
MITRE ATT&CK® Techniques Tactic Technique ID Technique Name ... Credential Access ... T1552 ... Unsecured Credentials
MITRE ATT&CK® Techniques Tactic Technique ID Technique Name ... Credential Access T1555 ... Credentials from Password Stores
Conclusion According to our research, the TAs behind Mars stealer are adopting sophisticated phishing attacks to distribute Mars Stealer and gather user credentials, system information, and other sensitive data.
In this scenario, an attacker traverses the target user’s filesystem, determines which wallet apps are installed, and then exfiltrates a predefined list of wallet files.
For anti-sandboxing, the stealer sleeps for 16000 milliseconds and calls GetTickCount API... If the value is less than 12000, it means that the Sleep function was skipped by the debugger or sandbox, and the sample exits.
Mars Stealer will exit if the following languages are detected... Uzbekistan Azerbaijan Kazakhstan Russia Belarus
For anti-debugging purposes, it manually checks the PEB (Process Environment Block) for BeingDebugged flag.
a simple but effective way to steal hot wallet data is to target the wallet application’s storage files... then exfiltrates a predefined list of wallet files.
The name of the file which the PrivateLoader bot used to exfiltrate data was ‘NOP8QIMGV3W47Y.zip’... Saving the hex data using a ‘.zip’ extension and extracting the contents, a file directory consisting of system information and Chrome and Edge browsers’ Autofill data in cleartext .txt file format could be seen.
The infected machine occasionally sends the POST requests to http://162.33.178[.]122/fakeurl.htm, which is a NetSupportManager server... The victim then reaches out to the Mars Stealer C2 server (/request)
Mars Stealer then bundles the stolen data and exfiltrates it to an attacker-controlled command-and-control (C2) server via HTTP POST.
After users’ devices were redirected to pages instructing them to download a password-protected archive, they subsequently contacted cdn.discordapp[.]com over SSL. The archive files which users downloaded over these SSL connections likely contained the PrivateLoader loader module.
The report’s Tactics, Techniques and Procedures section lists T1041 Exfiltration Over C2 Channel.
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.