General

  • Target

    7ba90aa0c59065b2cff53772013ce986674346b311025c13eefff32670d7ffe1

  • Size

    731KB

  • Sample

    211113-xlpwfacdan

  • MD5

    7e400451e3153f07e15e9079b8bed063

  • SHA1

    864298a6817176e36a756721f48e5ac9dee0223e

  • SHA256

    7ba90aa0c59065b2cff53772013ce986674346b311025c13eefff32670d7ffe1

  • SHA512

    277edc6d5931d7b5b41d77a79cf975e2065d74d3ed938153d31f709670cbf03744109b4c6fa967dc229865e1dc49aa62b4503b0230d61f2f824d4012c5e97556

Malware Config

Extracted

Family

oski

C2

takpo.biz

Targets

    • Target

      7ba90aa0c59065b2cff53772013ce986674346b311025c13eefff32670d7ffe1

    • Size

      731KB

    • MD5

      7e400451e3153f07e15e9079b8bed063

    • SHA1

      864298a6817176e36a756721f48e5ac9dee0223e

    • SHA256

      7ba90aa0c59065b2cff53772013ce986674346b311025c13eefff32670d7ffe1

    • SHA512

      277edc6d5931d7b5b41d77a79cf975e2065d74d3ed938153d31f709670cbf03744109b4c6fa967dc229865e1dc49aa62b4503b0230d61f2f824d4012c5e97556

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

    • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

      suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

      suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Tasks