General

  • Target

    Purchase Order 07052021.exe

  • Size

    819KB

  • Sample

    210507-gr7wceb356

  • MD5

    bdddbdfd52d8740ae768c48788804531

  • SHA1

    d2d1452cd22f11e136c6d96467f893aee0477398

  • SHA256

    138ccd9e494958214619110418407a634db9d8b073be4ffcd7d23083b58fb945

  • SHA512

    9e9c7f5563dbe473b165e95b4205c98962eb4854cad934296e5e37b9d2e642564a390334a98c86ec650f983938d762887a3184a6159af42aeab6a6bd375a7c29

Malware Config

Extracted

Family

oski

C2

209.141.49.199

Targets

    • Target

      Purchase Order 07052021.exe

    • Size

      819KB

    • MD5

      bdddbdfd52d8740ae768c48788804531

    • SHA1

      d2d1452cd22f11e136c6d96467f893aee0477398

    • SHA256

      138ccd9e494958214619110418407a634db9d8b073be4ffcd7d23083b58fb945

    • SHA512

      9e9c7f5563dbe473b165e95b4205c98962eb4854cad934296e5e37b9d2e642564a390334a98c86ec650f983938d762887a3184a6159af42aeab6a6bd375a7c29

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Tasks