Extracted

• • Target

    00001effb01cec7a867b5ccae0325fe1.exe

  • Size

    841KB

  • MD5

    00001effb01cec7a867b5ccae0325fe1

  • SHA1

    b739d4641afc15cb9b63a39bdc9c3a9b9cd05f01

  • SHA256

    6b95b02847bc1eae8b9b97da0cecb7f85f554314ecbea6affe44319ef1b5206b

  • SHA512

    6eb45861358cfb3e94a220dc632f8d2f12d357a4134c99dbdb5265ae3a768f93396b3d9973a93aca04deb9129e73ce176fe94a1d6dfe7d30374bd2730e6b6a2e

  Score

  10^/10

  oskidiscoveryevasioninfostealerspywarestealer

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

    infostealeroski

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Downloads MZ/PE file

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2