General

  • Target

    Payment Advice.exe

  • Size

    766KB

  • Sample

    210506-1f8yzjk9gj

  • MD5

    15dcf73ba7415cdddcbc2f840510cbd5

  • SHA1

    01bd1af8ccb0643cf153520210e7e7dcd7ff0ae7

  • SHA256

    0768e83e8d36f21ea90867dcf3935ee48795daf2e4a0017979e752b865c95d9e

  • SHA512

    faaf9c36ecd8135690d3166cccccab3a92e1a341cb17d061ed4bf748b3a6724c0b09b369d9749de98e1e1f11c43a070a530a55f4fa13aef79e1b4ac2bcf72c3d

Malware Config

Extracted

Family

oski

C2

209.141.49.199

Targets

    • Target

      Payment Advice.exe

    • Size

      766KB

    • MD5

      15dcf73ba7415cdddcbc2f840510cbd5

    • SHA1

      01bd1af8ccb0643cf153520210e7e7dcd7ff0ae7

    • SHA256

      0768e83e8d36f21ea90867dcf3935ee48795daf2e4a0017979e752b865c95d9e

    • SHA512

      faaf9c36ecd8135690d3166cccccab3a92e1a341cb17d061ed4bf748b3a6724c0b09b369d9749de98e1e1f11c43a070a530a55f4fa13aef79e1b4ac2bcf72c3d

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Tasks