Overview

overview

10

Static

static

7

SecuriteIn...21.exe

windows7_x64

10

SecuriteIn...21.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Win32.Packed.Themida.HKO.8521

  • Size

    5.3MB

  • Sample

    200711-pzkmyg3qja

  • MD5

    b24dc2820886e748d1619d824c898bc2

  • SHA1

    867e772a9e9bd75196f5f94e5802f9ee6e370c5c

  • SHA256

    32c17a6caeed78f79e06de58d5229927f77bc8c6b4865b41289d4da886a07df4

  • SHA512

    32bfaaa84c8cb15b988107d56b0a8645ba394da47e027026219afd8c8f7772b2697dc9e222229f860572deb871fbd22f6dbaeb528dd28f1219fd3a5ee2b674a2

Score
10/10
oskidiscoveryevasioninfostealerspywarestealerthemidatrojan

Malware Config

Targets

    • Target

      SecuriteInfo.com.Win32.Packed.Themida.HKO.8521

    • Size

      5.3MB

    • MD5

      b24dc2820886e748d1619d824c898bc2

    • SHA1

      867e772a9e9bd75196f5f94e5802f9ee6e370c5c

    • SHA256

      32c17a6caeed78f79e06de58d5229927f77bc8c6b4865b41289d4da886a07df4

    • SHA512

      32bfaaa84c8cb15b988107d56b0a8645ba394da47e027026219afd8c8f7772b2697dc9e222229f860572deb871fbd22f6dbaeb528dd28f1219fd3a5ee2b674a2

    Score
    10/10
    oskidiscoveryevasioninfostealerspywarestealertrojan

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

      infostealeroski

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

4
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks