oski

General

Target
cc41b92339a4d05cf4941a41c1b198d1.exe
Size 840KB
Sample201204-ez9jms45sn
SHA256 3ecfe375bd64aa9e53b2d439c8ea9974af664aa36d060239ae7ddd1d796e0309
MD5 cc41b92339a4d05cf4941a41c1b198d1
SHA1 023292b0b004739fb03cb417a28d8675633a5b2a
SHA512 c36bb4b4ce3250a5992a5ec3c99421d9d6115d557bb3d676644afb1f52da645ca0e68876fbdd86786c4d9970d3d0e655b8b1e546259a6f66a21928910da50131
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Targets

- Target
  cc41b92339a4d05cf4941a41c1b198d1.exe
- Size 840KB
- SHA256 3ecfe375bd64aa9e53b2d439c8ea9974af664aa36d060239ae7ddd1d796e0309
- MD5 cc41b92339a4d05cf4941a41c1b198d1
- SHA1 023292b0b004739fb03cb417a28d8675633a5b2a
- SHA512 c36bb4b4ce3250a5992a5ec3c99421d9d6115d557bb3d676644afb1f52da645ca0e68876fbdd86786c4d9970d3d0e655b8b1e546259a6f66a21928910da50131
- MD5 SHA1 SHA512
Score

10^/10

oski discovery infostealer spyware stealer
- Oski
  Oski is an infostealer targeting browser data, crypto wallets.
  infostealer oski
- Downloads MZ/PE file
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Deletes itself

Loads dropped DLL

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2