General

  • Target

    NEW ORDER_78947533.EXE

  • Size

    881KB

  • Sample

    210810-h5b7z52nnn

  • MD5

    7f05dc92a62ddd277baaeb55ebcfa407

  • SHA1

    23c8c1a1a8d16180980f4b38a47832738f947141

  • SHA256

    06c8a1e6544aede327bad32a5732d5bcfff143da73da01d34938efbe917e3289

  • SHA512

    3cf46fbbf2e197b15fff65b3250f05add05537e534371ee50c8f0fe6524d4d32717d25ec79c60b8ebd1ed34b99d36522202834ac927fe3e1be5abb7c298768ef

Malware Config

Extracted

Family

oski

C2

kckark.xyz

Targets

    • Target

      NEW ORDER_78947533.EXE

    • Size

      881KB

    • MD5

      7f05dc92a62ddd277baaeb55ebcfa407

    • SHA1

      23c8c1a1a8d16180980f4b38a47832738f947141

    • SHA256

      06c8a1e6544aede327bad32a5732d5bcfff143da73da01d34938efbe917e3289

    • SHA512

      3cf46fbbf2e197b15fff65b3250f05add05537e534371ee50c8f0fe6524d4d32717d25ec79c60b8ebd1ed34b99d36522202834ac927fe3e1be5abb7c298768ef

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks