Overview

overview

10

Static

static

IMG052361778.exe

windows7_x64

10

IMG052361778.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    IMG052361778.exe

  • Size

    691KB

  • Sample

    210506-e5wssk39n2

  • MD5

    74a962db45d6ab6c859ff627987bf1f6

  • SHA1

    893b19a862fca02a5ec9ab0cd270a4970849ecb1

  • SHA256

    c210434fcb39927f4a0d0a844a1a883f8274bc3b9e6d3e6e883f8072f316ca6a

  • SHA512

    3a4e33f3f625e6c861eebb71a50bfbb693c102b896118d808317b546a7e6dbf28fe91b549b58d723dc27a207063a9822404ef8df3dd4a986e489b0851b1c999c

Score
10/10
oskidiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

oski

C2

193.142.59.33

Targets

    • Target

      IMG052361778.exe

    • Size

      691KB

    • MD5

      74a962db45d6ab6c859ff627987bf1f6

    • SHA1

      893b19a862fca02a5ec9ab0cd270a4970849ecb1

    • SHA256

      c210434fcb39927f4a0d0a844a1a883f8274bc3b9e6d3e6e883f8072f316ca6a

    • SHA512

      3a4e33f3f625e6c861eebb71a50bfbb693c102b896118d808317b546a7e6dbf28fe91b549b58d723dc27a207063a9822404ef8df3dd4a986e489b0851b1c999c

    Score
    10/10
    oskidiscoveryinfostealerspywarestealer

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

      infostealeroski

    • Downloads MZ/PE file

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks