Mars

Malware Profile Updated 15 days ago
Download STIX
Preview STIX
Mars is a malicious software (malware) that has been discovered by Trend Micro's Mobile Application Reputation Service (MARS) team. This malware is particularly damaging as it involves two new Android malware families related to cryptocurrency mining and financially-motivated scam campaigns, targeting Android users. The MARS team also uncovered a new undetected Android banking trojan called MMRat, which has been attacking mobile users in Southeast Asia since late June 2023. The Mars malware is part of a broader threat landscape, which includes other notable clones such as "Oski" and "Vidar", suggesting that the proliferation of these clones is due to the malware being cracked. The Mars malware was identified alongside other products offered by Intellexa, including a network injection system installed at mobile operator ISPs that silently redirects any unencrypted HTTP request from a smartphone to a Predator infection server. An add-on for Mars, Jupiter, can inject into encrypted HTTPS traffic but only works with domestic websites hosted by a local ISP. These discoveries underscore the importance of supply-chain cybersecurity, especially for high-stakes operations like NASA's multi-billion-dollar Artemis-to-Mars program. Trend Micro's MARS uses leading sandbox and machine learning technologies to protect devices against malware, zero-day and known exploits, privacy leaks, and application vulnerabilities. This is crucial given the evolving nature of threats like Mars and its variants. The ongoing research and discovery of these threats highlight the need for robust security measures and the continuous development of innovative solutions to counteract these evolving cyber threats.
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
Vidar
3
Vidar is a Windows-based malware written in C++, derived from the Arkei stealer, which is designed to infiltrate and exploit computer systems. It has been used alongside other malware variants such as Emotet, IcedID, CobaltStrike, SVCReady, CargoBay, Pushdo, Minodo, DiceLoader, AresLoader, LummaC2,
Mmrat
2
MMRat is a newly discovered Android banking trojan that has been targeting mobile users in Southeast Asia since June 2023. The malware was initially detected by the Trend Micro Mobile Application Reputation Service (MARS) team, but surprisingly, popular antivirus scanning services like VirusTotal fa
Oski
1
Oski is a type of malware, specifically a stealer, that emerged as a clone of the Vidar malware, following the latter's leak. It was created to exploit and damage computer systems by infiltrating through suspicious downloads, emails, or websites, often unbeknownst to the user. Once it gains access t
Lumma
1
Lumma is a prominent malware, particularly known as an information stealer. It is delivered through various means, including suspicious downloads, emails, and websites. In one instance observed by Palo Alto Networks’ Unit 42, Lumma was sent over Latrodectus C2 in an infection chain. In another campa
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Malware
Android
Trojan
Fbi
Bot
Ransomware
Infostealer
Scam
Intellexa
Ios
Celas Trade ...
Azure
Korean
Sandbox
UAE
Russia
Barracuda
CISA
Vulnerability
XSS (Cross S...
Backdoor
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
RedlineUnspecified
3
RedLine is a malware designed to exploit and damage computer systems by stealing personal information, disrupting operations, or even holding data hostage for ransom. It has been identified as a favorite infostealer among threat actors selling logs through the marketplace 2easy, which also sells Rac
RaccoonUnspecified
2
Raccoon is a highly potent and cost-effective Malware-as-a-Service (MaaS) primarily sold on dark web forums, used extensively by Scattered Spider threat actors to pilfer sensitive data. As per the "eSentire Threat Intelligence Malware Analysis: Raccoon Stealer v2.0" report published on August 31, 20
StealcUnspecified
2
Stealc is a malicious software (malware) that specifically targets browser extensions and authenticators by password managers, growing in popularity on the dark web since its discovery in early 2023. It has been associated with significant cyber-attacks, such as the $7 million heist on the Solana bl
RoverUnspecified
1
Rover is a malicious software, also known as malware, that is designed to exploit and damage computer systems or devices. The term "rover" in this context seems unrelated to the various uses of the term in the information provided, such as the Mars Rover program, the Range Rover vehicle, or the Jagu
PhobosUnspecified
1
Phobos is a type of malware, specifically a ransomware, that has been a significant cause for concern in the cyber security world. This malicious software infiltrates systems through dubious downloads, emails, or websites and can cause severe damage by stealing personal information, disrupting opera
Cryptoneuro TraderUnspecified
1
CryptoNeuro Trader is a malicious software (malware) that has been used to target and exploit hundreds of cryptocurrency companies, leading to the theft of tens of millions of dollars' worth of cryptocurrency. Notable incidents include the theft of $75 million from a Slovenian company in December 20
AppleJeusUnspecified
1
AppleJeus is a notorious malware attributed to the North Korean APT Lazarus Group, designed primarily to steal cryptocurrency. This malicious software has been a key instrument in North Korea's financial theft operations, with threat groups pilfering $2.3 billion USD worth of crypto assets between M
Ants2whaleUnspecified
1
Ants2Whale is a malicious software (malware) identified as the seventh version of AppleJeus, a notorious family of North Korean malware targeting cryptocurrency operations. First discovered in late 2020, Ants2Whale operates similarly to its predecessors, with its main function being to provide hacke
RiseproUnspecified
1
RisePro is a type of malware, specifically an info-stealer, designed to infiltrate and damage computer systems. It operates by exploiting vulnerabilities in a device, often through suspicious downloads, emails, or websites, typically without the user's knowledge. Once inside, RisePro can disrupt ope
AuroraUnspecified
1
Aurora is a type of malware designed to exploit and damage computer systems, often through suspicious downloads, emails, or websites. It has been used in a series of high-profile cyber-attacks over the years, with notable instances such as Operation Aurora in 2009, which targeted major technology co
LokibotUnspecified
1
LokiBot is a malicious software, or malware, that was first reported on October 24, 2020. It is designed to exploit and damage computer systems by infiltrating them through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, LokiBot steals personal information
PredatorUnspecified
1
Predator is a potent malware that, along with NSO Group's Pegasus, remains a leading provider of mercenary spyware. Despite public disclosures in September 2023, Predator's operators have continued their operations with minimal changes, exploiting recently patched zero-day vulnerabilities in Apple a
CarbanakUnspecified
1
Carbanak is a sophisticated type of malware, short for malicious software, that is designed to exploit and damage computer systems. It can infiltrate systems through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, it can steal personal information, disrupt
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
HIDDEN COBRAUnspecified
1
Hidden Cobra, also known as the Lazarus Group and Sapphire Sleet, is a North Korean cyberespionage group that has been active since at least 2009. The U.S. Government uses the term Hidden Cobra to refer to malicious cyber activities by the North Korean government, with the BeagleBoyz representing a
MERCURYUnspecified
1
Mercury, also known as MuddyWater and Static Kitten, is a threat actor group linked to global espionage activities, with suspected ties to the Iranian Ministry of Intelligence and Security. This group has been noted for its malicious activities, compromising multiple victims that another group, POLO
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Source Document References
Information about the Mars Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
InfoSecurity-magazine
15 days ago
Fraud Campaign Targets Russians with Fake Olympics Tickets
MITRE
a year ago
Mobile Campaign ‘Bouncing Golf’ Affects Middle East
Trend Micro
a year ago
MMRat Carries Out Bank Fraud Via Fake App Stores
CERT-EU
a year ago
Hacking, not shoe-leather, solves thriller ‘Missing’ | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #hacker - National Cyber Security
InfoSecurity-magazine
a year ago
Researchers Uncover New Information Stealer 'Stealc'
Flashpoint
a year ago
“RisePro” Stealer and Pay-Per-Install Malware “PrivateLoader”
CERT-EU
a year ago
This NASA project really shows the need for supply chain security | Federal News Network
CERT-EU
9 months ago
Signal Debunks Zero-Day Vulnerability Reports, Finds No Evidence
CERT-EU
a year ago
Partner Content | Tech Update: $30M for quantum research and Ottawa builds a drone testing ground
BankInfoSecurity
8 months ago
Info Stealers Thrive in Hot Market for Stolen Data
CERT-EU
9 months ago
Search | arXiv e-print repository
Trend Micro
a year ago
Related CherryBlos and FakeTrade Android Malware Involved in Scam Campaigns
CERT-EU
a year ago
Partner Content | Tech Update: Steelmaker invests in decarbonizing technology and ransomware bills keep rising
CERT-EU
7 months ago
Private US lunar lander hits technical problems on way to the Moon
Flashpoint
7 months ago
The Evolution and Rise of Stealer Malware
CERT-EU
7 months ago
Autonomous systems becoming preferred choice in Order of Battle for nations across the globe: Navy Chief
Securityaffairs
a year ago
Stealc, a new advanced infostealer appears in the threat landscape
CERT-EU
5 months ago
U.S. achieves first moon landing in half-century with private spacecraft
CISA
a year ago
CISA Releases IOCs Associated with Malicious Barracuda Activity | CISA
CERT-EU
7 months ago
Man insisting on referring to basic cookery tips as ‘food hacking’ | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #hacker | National Cyber Security Consulting