General

  • Target

    SecuriteInfo.com.Mal.Generic-S.28463.8334

  • Size

    772KB

  • Sample

    201109-wb671rcjwx

  • MD5

    65e641e56046e02afa450a6b45becbf3

  • SHA1

    4ff9cc7a7322fb54a9f45d6bab2c71992a729ea7

  • SHA256

    dd22eb456a9a1b80eb044458c761643ba2a47acbe1f98e76b0efecc9a80f4488

  • SHA512

    d8dab099d9ee4efb2df7ed21ad1c3d9290bc230cf8db75c95f7e8f3cd63b8c8b20184043012a7f08a6b90eb2b175413b23a1cb53c9de59dce0d23c3f3d2913d7

Malware Config

Targets

    • Target

      SecuriteInfo.com.Mal.Generic-S.28463.8334

    • Size

      772KB

    • MD5

      65e641e56046e02afa450a6b45becbf3

    • SHA1

      4ff9cc7a7322fb54a9f45d6bab2c71992a729ea7

    • SHA256

      dd22eb456a9a1b80eb044458c761643ba2a47acbe1f98e76b0efecc9a80f4488

    • SHA512

      d8dab099d9ee4efb2df7ed21ad1c3d9290bc230cf8db75c95f7e8f3cd63b8c8b20184043012a7f08a6b90eb2b175413b23a1cb53c9de59dce0d23c3f3d2913d7

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Tasks