Extracted

• • Target

    8013b5ae4a210f76c8064e4e9c440fc4741364e9e3e3ef3794733762e1362866

  • Size

    81KB

  • MD5

    c4d5a9e052e1e81e33658247863a2a0e

  • SHA1

    539f1241fe23603b64b5417317b7b69876537a24

  • SHA256

    8013b5ae4a210f76c8064e4e9c440fc4741364e9e3e3ef3794733762e1362866

  • SHA512

    cf9ed0c1c28d17be440d754ae191a72a0d9579948ec32d93ad7f905ff1faec032ea46b3d148267e5fb5fb4d2265cf6b1c3200d3ba436059adb971601505a0344

  Score

  10^/10

  oskiinfostealerspyware

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

    infostealeroski

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Process spawned suspicious child process

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2