General

  • Target

    9c4dae36c101af2a1bf1b1de16ee5868

  • Size

    706KB

  • Sample

    201117-ksmn5mxkg6

  • MD5

    0182af9982ae6d609fc1c4064e78cf53

  • SHA1

    26a35397fff53ec1b8417cb697cc94afa83dadf6

  • SHA256

    778d504c99fbb7e6962f98b1bc833a9e621a1dd77e18a881831643e6461b4f39

  • SHA512

    a4d1182b86c812cded44e7150d6eb657a1ff255a2a0561abde8989d2f45a44790ed5ebfc8b4a17b4773290275254444c747488fd1cfbdfd31199a72e23a94833

Malware Config

Extracted

Family

oski

C2

morasergiov.ac.ug

Targets

    • Target

      9c4dae36c101af2a1bf1b1de16ee5868

    • Size

      706KB

    • MD5

      0182af9982ae6d609fc1c4064e78cf53

    • SHA1

      26a35397fff53ec1b8417cb697cc94afa83dadf6

    • SHA256

      778d504c99fbb7e6962f98b1bc833a9e621a1dd77e18a881831643e6461b4f39

    • SHA512

      a4d1182b86c812cded44e7150d6eb657a1ff255a2a0561abde8989d2f45a44790ed5ebfc8b4a17b4773290275254444c747488fd1cfbdfd31199a72e23a94833

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

    • Downloads MZ/PE file

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Tasks