Mars Stealer is a Windows info-stealer first publicly tracked
in mid-2021. It is a fork of the older Oski Stealer code base
and harvests browser credentials, crypto wallets, MFA
extensions, and Telegram / Discord session data. The family is
documented in public malware analyses from 2022 onward,
including the March 2022 source-code-leak disclosure, and is
tracked under the canonical literal win.mars_stealer. The
source-code leak in March 2022 produced a wave of derivative
builders that ship the same panel-template vocabulary with
minor field-block restructures; downstream consumers see
Mars-lineage logs from the @bradmax_cloud and other
redistributor channels that resell builder output without
naming the specific fork.
The harvested log opens with an 11-field plain Key: Value
system block: Country, IP, Time Zone, a language
sub-block, Processor, Installed RAM (with the Installed
prefix), OS (formatted as Windows <N> build <NNNNN> (64 Bit)), Video card (space + lowercase card), and Display Resolution (as WxH). The native Mars language sub-block has
two fields (Display Language: plus Keyboard Languages:)
per public analyses; post-leak forks have been observed
restructuring the sub-block (for example the three-field
System Language / User Language / Keyboard Language
variant the @bradmax_cloud redistributor ships). Below the
system block, 33-hyphen separators delimit three sections: a
browser-version inventory listing every binary version found
on disk per browser, a 4-field installed-software inventory
(Display Name: / Publisher: / Version: / Install Source:), and a flat KEY = value environment-variable dump.
