TrojanSpy.Win32.MARSTEALER.B
Windows
![](/vinfo/imgFiles/legend.jpg)
Threat Type: Trojan Spy
Destructiveness: No
Encrypted: Yes
In the wild: Yes
OVERVIEW
Downloaded from the Internet
This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It executes then deletes itself afterward.
It gathers certain information on the affected computer.
TECHNICAL DETAILS
162,304 bytes
EXE
No
31 Mar 2022
Connects to URLs/IPs
Arrival Details
This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This Trojan Spy drops the following files:
- {Malware Path}\{Stolen File} → Delete Afterwards
- {Malware Path}\{8 random characters} → Delete Afterwards
It adds the following processes:
- "%System%\cmd.exe" /c timeout /t 5 & del /f /q "{Malware Path\Malware Filename}" & exit
(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)
It executes then deletes itself afterward.
Information Theft
This Trojan Spy gathers the following information on the affected computer:
- Telegram session data
- Discord session data
- Browser data (e.g. cookies, downloads, history, credentials, autofills, credit card data)
- Chrome
- ChromeBeta
- ChromeCanary
- Chromium
- Edge_Chromium
- Kometa
- Amigo
- Torch
- Orbitum
- Comodo
- Nichrome
- Maxthon5
- Sputnik
- EPB
- Vivaldi
- CocCoc
- Uran
- QIP
- Cent
- Elements
- TorBro
- CryptoTab
- Brave
- Opera
- OperaGX
- OperaNeon
- Firefo
- SlimBrowser
- PaleMoon
- Waterfox
- Cyberfox
- BlackHawk
- IceCat
- KMeleo
- Cryptocurrency Wallet data
- Ethereum
- Electrum
- ElectrumLTC
- Exodus
- ElectronCash
- MultiDoge
- JAXX
- Atomic
- Binance
- Coinomi
- IP
- Country
- Working Path
- Language
- Keyboard layout
- RAM information
- Processor information
- Video card information
- Display Resolution
- Computer name
- Username
- Domain name
- Machine ID
- GUID
- Installed Software
- Screenshot
- Time executed
- Device used
- Operating System
- It gather files based on its configuration file received from the C&C server.
- *.txt
- *.xss
- *.seco
- *.doc
- *.zip
- *.json
- Mail client:
- Thunderbird
Stolen Information
This Trojan Spy sends the gathered information via HTTP POST to the following URL:
- http://{BLOCKED}.{BLOCKED}.41.179/game.php
NOTES:
This Trojan Spy does the following:
- It connects to the following URL to resolve its configuration:
- http://{BLOCKED}.{BLOCKED}.41.179/game.php
- It connects the following URL to download normal files in %ProgramData%:
- http://{BLOCKED}.{BLOCKED}.41.179/request
- freebl3.dll
- mozglue.dll
- msvcp140.dll
- nss3.dll
- softokn3.dll
- vcruntime140.dll
- It terminates itself if any of the locale identifiers is found:
- Kazakh (Kazakhstan)
- Russian (Russia)
- Belarusian (Belarus)
- Uzbek (Latin, Uzbekistan)
- Azerbaijani (Cyrillic, Azerbaijan)
- It terminates itself if any of the following computer name(s) are found in the affected system:
- HAL9TH If true, checks if username is
- JohnDoe
- It will terminate itself if the current date is greater than 04/07/2022
SOLUTION
9.800
17.476.07
31 Mar 2022
17.477.00
01 Apr 2022
Step 1
Trend Micro Predictive Machine Learning detects and blocks malware at the first sign of its existence, before it executes on your system. When enabled, your Trend Micro product detects this malware under the following machine learning name:
- Troj.Win32.TRX.XXPE50FFF055
Step 2
Before doing any scans, Windows 7, Windows 8, Windows 8.1, and Windows 10 users must disable System Restore to allow full scanning of their computers.
Step 3
Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.
Step 4
Search and delete this file
- {Malware Path}\{8 random characters}
Step 5
Scan your computer with your Trend Micro product to delete files detected as TrojanSpy.Win32.MARSTEALER.B. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:
Did this description help? Tell us how we did.