Overview

overview

10

Static

static

8b9848190f...27.exe

windows7_x64

10

8b9848190f...27.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8b9848190fb40aacc6365ec2d27b1db47b12f027.exe

  • Size

    466KB

  • Sample

    211018-x591qafden

  • MD5

    3b546310e40b24c209f03b25f50b6360

  • SHA1

    8b9848190fb40aacc6365ec2d27b1db47b12f027

  • SHA256

    1e06feaa8bffafea07e7b94ca87987d61c6e5d0afb520e7c065d7facc10d4b88

  • SHA512

    27ced9beccce1699f0bbbacb1a0aa13433f3d9085147853f1c078ab5eceff0664e6b7b716815a2045c9cd4b33a965c1dd4ee2d56bdab7a93f421a789f4aaad8f

Score
10/10
oskiinfostealerspywaresuricata

Malware Config

Extracted

Family

oski

C2

aboliki.xyz

Targets

    • Target

      8b9848190fb40aacc6365ec2d27b1db47b12f027.exe

    • Size

      466KB

    • MD5

      3b546310e40b24c209f03b25f50b6360

    • SHA1

      8b9848190fb40aacc6365ec2d27b1db47b12f027

    • SHA256

      1e06feaa8bffafea07e7b94ca87987d61c6e5d0afb520e7c065d7facc10d4b88

    • SHA512

      27ced9beccce1699f0bbbacb1a0aa13433f3d9085147853f1c078ab5eceff0664e6b7b716815a2045c9cd4b33a965c1dd4ee2d56bdab7a93f421a789f4aaad8f

    Score
    10/10
    oskiinfostealerspywaresuricata

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

      infostealeroski

    • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

      suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

      suricata

    • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

      suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

      suricata

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Scripting

1
T1064

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks