General

  • Target

    Inquirypdf.exe

  • Size

    447KB

  • Sample

    220413-v47g4aeafr

  • MD5

    2894bf86ecc7f9ced40ca45457555a04

  • SHA1

    ec7ea2e1d94da696695a1d74ec01ef7713056a62

  • SHA256

    aec9eb81f2a2837488165119d41da8eec94607b9bde0b729f811ced008ad95cb

  • SHA512

    47ab31b106de2a0ba216a0a24d12b973bcecb33d6fb506536126dfcdb1d9de3e5fe6fc7ad605f0194fc4b3adda3a87694ef2703cc4b54c503ea89265d7d9f6fc

Malware Config

Extracted

Family

oski

C2

ndy.derg.tech

Targets

    • Target

      Inquirypdf.exe

    • Size

      447KB

    • MD5

      2894bf86ecc7f9ced40ca45457555a04

    • SHA1

      ec7ea2e1d94da696695a1d74ec01ef7713056a62

    • SHA256

      aec9eb81f2a2837488165119d41da8eec94607b9bde0b729f811ced008ad95cb

    • SHA512

      47ab31b106de2a0ba216a0a24d12b973bcecb33d6fb506536126dfcdb1d9de3e5fe6fc7ad605f0194fc4b3adda3a87694ef2703cc4b54c503ea89265d7d9f6fc

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

    • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

      suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) M2

      suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) M2

    • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (passwords.txt) M2

      suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (passwords.txt) M2

    • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

      suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern

      suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks