Overview

overview

10

Static

static

1

MedNet

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    moto hr.bin

  • Size

    249KB

  • Sample

    210419-11qxaagls2

  • MD5

    116deb673468e1ac1cb77fe490ee1d81

  • SHA1

    d5ba419a4300b73b6aa3c725c33c8e083675f403

  • SHA256

    fc20db6fb74a2d4bf69f5035690a553ac349ddebdf87eb417a587d0ffb272d01

  • SHA512

    7ceded6d75afb547c4f82b071f0096a393fdf27771c47ea8d3fb2e739aac570cbff579b54323e2d8ac1d450b8c1093f0e225b5e56fd3704041253e829e1225fb

Score
10/10
oskidiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

oski

C2

45.144.225.118

Targets

    • Target

      moto hr.bin

    • Size

      249KB

    • MD5

      116deb673468e1ac1cb77fe490ee1d81

    • SHA1

      d5ba419a4300b73b6aa3c725c33c8e083675f403

    • SHA256

      fc20db6fb74a2d4bf69f5035690a553ac349ddebdf87eb417a587d0ffb272d01

    • SHA512

      7ceded6d75afb547c4f82b071f0096a393fdf27771c47ea8d3fb2e739aac570cbff579b54323e2d8ac1d450b8c1093f0e225b5e56fd3704041253e829e1225fb

    Score
    10/10
    oskidiscoveryinfostealerspywarestealer

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

      infostealeroski

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks