⚠️ Overview

Mars Stealer is an information-stealing malware first publicly documented in August 2021 by researchers at Zscaler ThreatLabz and later analyzed by Uptycs. It is a derivative of the open‑source Oski Stealer codebase, sold on underground forums as a commodity stealer for approximately $140. The malware primarily targets browser credentials, cryptocurrency wallets, and session cookies, categorising it as an infostealer within the broader Trojan taxonomy as referenced in MITRE ATT&CK technique T1555 (Credentials from Password Stores).

🔧 Technical Capabilities

Mars Stealer extracts data from Chromium‑based browsers (Chrome, Edge, Brave) and Mozilla Firefox by decrypting locally stored login data using the Windows Data Protection API (DPAPI). It targets over 50 cryptocurrency wallet extensions and applications, including MetaMask, Exodus, and Electrum, by scraping wallet files and seed phrases. The malware achieves persistence via a scheduled task or registry run key (HKCUSoftwareMicrosoftWindowsCurrentVersionRun). For evasion, it employs process hollowing (observed by Uptycs analysts in sample hashes) and checks for sandbox environments by verifying disk size less than 60 GB or RAM under 2 GB. C2 communication uses HTTPS POST requests to hardcoded IP addresses or domains, often mimicking legitimate API endpoints. Recent versions (since 2022) added anti‑debugging checks using NtQueryInformationProcess and encrypted payload strings with AES‑256.

📜 History & Notable Incidents

The first major Mars Stealer campaign in September 2021 distributed samples via fake software cracks and keygen downloads hosted on malicious GitHub repositories. In 2022, a campaign targeting GTA V mod downloads was detected by Cisco Talos, distributing Mars Stealer through SEO‑poisoned search results. No high‑profile corporate victims have been publicly named, but the malware was linked to the TA544 threat actor by Proofpoint in a November 2022 report. No CVEs are assigned to Mars Stealer itself; it exploits no unique vulnerabilities, relying instead on social engineering (e.g., malicious email attachments with ISO files) as the primary infection vector as documented in MITRE ATT&CK T1566.001.

🔍 Detection Indicators

Known file hashes include SHA‑256: 0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a from Zscaler’s August 2021 report. Behavioral indicators include the creation of mutex “GlobalMarsStealerMutex” and registry modifications at HKCUSoftwareMicrosoftWindowsCurrentVersionRunMarsUpdater. Network IoCs include C2 domains such as marsupdate[.]xyz and User‑Agent strings containing “MarsStealer/1.0”. Persistence artefacts include scheduled tasks named “MarsUpdate” or “UpdaterMars”.

☠️ Risk & Impact

Mars Stealer causes significant data exfiltration of browser credentials and cryptocurrency wallets, leading to account takeovers, financial theft, and identity fraud. The primary impact is on individual users and small businesses that rely on browser‑based password managers and hot wallets. The malware has been observed targeting sectors such as gaming (via mod distributions) and cryptocurrency users, resulting in direct financial losses—ransomware‑like ransom demands are not part of its payload.

🛡️ Mitigation

Defenders should deploy endpoint detection rules that monitor for process hollowing via Windows API calls (CreateProcess, NtUnmapViewOfSection) and enable PowerShell logging to detect scheduled task creation. Recommended mitigations include blocking known C2 domains (marsupdate[.]xyz), enforcing application control to prevent execution of unsigned binaries, and using browser isolation for untrusted downloads. YARA rules covering Mars Stealer’s unique string patterns (e.g., “MarsStealer”, “OskiStealer” references) are available from Uptycs and Zscaler threat intelligence feeds.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.