Loading malware…
Mars Stealer is an information-stealing malware family first observed in 2021 and sold on underground forums, including Russian-speaking forums, as a successor to Oski Stealer and part of the Arkei-derived stealer lineage alongside Vidar and Oski. It has been described as targeting Windows systems and stealing browser data, stored credentials, cookies, autofill data, password-manager data, Discord data, downloads, browsing history, screenshots, certificates, RDP credentials, and cryptocurrency-related data including browser extensions, crypto extensions, web wallets, desktop wallets, wallet files, and 2FA plugins/extensions. Reported capabilities include loader and grabber functionality, self-deletion, anti-debugging, anti-sandboxing, anti-emulation checks, language-based execution avoidance, and mutex-based reinfection avoidance. In one analyzed sample, Mars Stealer loaded a renamed copy of NTDLL.DLL and injected itself into explorer.exe to help evade EDR monitoring.
Observed delivery vectors in the provided content include Hancitor follow-on infections, a Colibri Loader campaign initiated via a malicious Word document using remote template injection and PowerShell/BITS to fetch the loader, phishing via a fake Atomic Wallet website that delivered a ZIP containing a malicious batch file, and a fake ChromeSetup ISO hosted on a malicious domain that installed NetSupportManager RAT before deploying Mars Stealer through obfuscated AutoIt scripts. The Atomic Wallet campaign used PowerShell, Base64 decoding, AES decryption, and GZip decompression, then downloaded Mars Stealer from a Discord server into %LOCALAPPDATA%. The Colibri campaign ultimately delivered a Mars Stealer payload after establishing persistence. Mars Stealer has also been associated with cryptocurrency-focused theft activity and is cited by Microsoft as an example of "cryware."
Behavior noted in the content includes retrieval of legitimate DLL dependencies; unlike Vidar and Oski, current Mars Stealer samples retrieved required DLLs as a single ZIP archive. Exfiltration was described as HTTP POST of ZIP archives containing stolen data to command-and-control servers. Specific infrastructure and indicators directly mentioned include a March 2022 sample with SHA-256 7022a16d455a3ad78d0bbeeb2793cb35e48822c3a0a8d9eaa326ffc91dd9e625 using sughicent[.]com and 5.63.155[.]126:80; a fake Atomic Wallet campaign using atomic-wallet[.]net, bit[.]ly/3PRDyH8, batch file SHA-256 33d0d9fe89f0dba2b89347a0e2e6deb22542476d98676187f8c1eb529cb3997f, and Mars Stealer executable SHA-256 10afe233525aaf99064e4e444f11a8fc01f8b9f508e4f123fd76b314a6d360f9; a Colibri-delivered Mars payload install.exe with SHA-256 b92f4b4684951ff2e5abdb1280e6bff80a14b83f25e4f3de39985f188d0f3aad; and an intrusion using googleglstatupdt[.]com/LEND/ChromeSetup[.]iso, AutoIt scripts una.wmd, fervore.wmd, and vai.wmd, RC4 key 344868553478223918282826525, and mutex 67820366929896267194. CERT-UA also lists MARSSTEALER among tools used by UAC-0050, but the provided content does not attribute Mars Stealer exclusively to that actor.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Malware advertised in underground forums as Mars Stealer started to appear in 2021.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
Mars Stealer has been delivered as a drive-by download via cloned websites for known software, such as Open Office.
The phishing site “hxxp://atomic-wallet[.]net” uses the icon and name of the Atomic wallet. Additionally, the Threat Actor is trying to copy the UI of a genuine website to trick the user... When the user clicks on the “Download for Windows” button, it connects to shortened URL ... and downloads a Zip file named “Atomic Wallet.zip”.
aNpRAHx.exe (original name: 3uAirPlayer.exe) was used to plant the following AutoIt scripts... The AutoIt scripts were highly obfuscated.
When the user clicks on the “Download for Windows” button, it connects to shortened URL ... and downloads a Zip file named “Atomic Wallet.zip”. The downloaded Zip file contains the “AtomicWallet-Setup.bat” file containing malicious code. Upon execution, the .bat file invokes the Powershell command...
The AutoIt scripts were highly obfuscated... The strings in .RDATA section are XOR’ed with different keys... The obfuscation mechanism is also identical to the previous versions of Mars Stealer: RC4 decryption key and Base64 strings.
The NetSupportManager RAT was obfuscated by the attacker as ‘21m_18_033.exe’... another executable was dropped via the remote session on the victim’s machine – consoleappmrss.exe.
NTDLL.DLL is responsible for injecting Mars Stealer into explorer.exe module during the runtime.
Mars Stealer can self-delete itself after successfully exfiltrating the victim’s data... The self-delete command is executed via command line: /c timeout /t 5 & del /f /q "%s" & exit
def deobfuscate(address): ... dp = Dumpulator("mars_stealer.dump", quiet=True) ... out = dp.read_str(dp.regs.ecx) return out ... for s in starting_points: ... print(f'Address { hex ( s ) } : { deobfuscate ( s ) } ' )
For anti-sandboxing, the stealer sleeps for 16000 milliseconds and calls GetTickCount API... If the value is less than 12000, it means that the Sleep function was skipped by the debugger or sandbox, and the sample exits.
The .bat file then copies powershell.exe into the current directory, renames it as AtomicWallet_Setup.bat.exe, and then hides it using the attrib command.
MITRE ATT&CK® Techniques ... Credential Access ... T1528 ... Steal Application Access Token.
MITRE ATT&CK® Techniques ... Credential Access ... T1539 ... Steal Web Session Cookies.
The stealer fingerprints the following information on the infected machine and outputs it to system.txt file: Country IP Working Path Local Time Time Zone Display Language Keyboard Languages Laptop/Desktop Processor Installed RAM OS Video card Display Resolution PC name Username Installed Software
The grabber functionality allows the attacker(s) to specify what files to collect, from which paths and the maximum file size.
For anti-sandboxing, the stealer sleeps for 16000 milliseconds and calls GetTickCount API... If the value is less than 12000, it means that the Sleep function was skipped by the debugger or sandbox, and the sample exits.
The infected machine occasionally sends the POST requests to http://162.33.178[.]122/fakeurl.htm, which is a NetSupportManager server... The victim then reaches out to the Mars Stealer C2 server (/request)
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as the likely predecessor or origin family for Lumma Stealer.
The content references a memory dump named "mars_stealer.dump" and a deobfuscation routine, indicating analysis of the Mars Stealer malware and its obfuscated strings.
An information stealer distributed via a fake Atomic Wallet phishing site. It targets browser extensions, crypto extensions and wallets, and 2FA plugins, steals sensitive information from infected devices, and exfiltrates the data to a C&C server.
Information-stealing malware and successor to Oski Stealer. It steals browser data, credentials, crypto wallet data, 2FA extension data, RDP credentials, certificates, and system information; supports grabber and loader functions; uses anti-debugging, anti-sandboxing, language checks, explorer.exe injection, custom-loaded NTDLL.DLL for EDR evasion, and can self-delete after exfiltration.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.