General
-
Target
Oski_notedemo.com.tr.ht.exe
-
Size
200KB
-
Sample
210722-8pbnwzap6e
-
MD5
884c97781aefe7f3f8aef45d44fa9340
-
SHA1
4d340d7a615e07b8d2c9d27e9d94862ea40bb577
-
SHA256
3bd85c9e47dd89f20f5ae78807a8e98288195c70ee6250e0e86583c672685119
-
SHA512
4f30c56596877c7b7fbd217cc03094d8e3bd5929d5aa52816d90414d4734523c7f61310cf15105dd2130c34f3dcf5799810dda4039f850af6d486910cf83d466
Static task
static1
Behavioral task
behavioral1
Sample
Oski_notedemo.com.tr.ht.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Oski_notedemo.com.tr.ht.exe
Resource
win10v20210410
Malware Config
Extracted
oski
notedemo.com.tr.ht
Targets
-
-
Target
Oski_notedemo.com.tr.ht.exe
-
Size
200KB
-
MD5
884c97781aefe7f3f8aef45d44fa9340
-
SHA1
4d340d7a615e07b8d2c9d27e9d94862ea40bb577
-
SHA256
3bd85c9e47dd89f20f5ae78807a8e98288195c70ee6250e0e86583c672685119
-
SHA512
4f30c56596877c7b7fbd217cc03094d8e3bd5929d5aa52816d90414d4734523c7f61310cf15105dd2130c34f3dcf5799810dda4039f850af6d486910cf83d466
Score10/10-
Downloads MZ/PE file
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-