General

  • Target

    48df9e78bff66e93455ddfdc35ad1ea6.exe

  • Size

    654KB

  • Sample

    220520-r21d8abgam

  • MD5

    48df9e78bff66e93455ddfdc35ad1ea6

  • SHA1

    5ad96da90b795a2cc65136a6dfc587b53496eb0a

  • SHA256

    ed6326f78b006f0c6658085f64b1e1aa302578039669b6bb606dcf471bd5defb

  • SHA512

    c3daea047db038e8b51c90d2c2797afa60cbcf6b2541e489536c9673029a2ae6eeceb7f72f89f28ec0579863d332753d1ab4e80501b84e7c154130a751fd5afa

Malware Config

Extracted

Family

oski

C2

spetralnet2.com

Targets

    • Target

      48df9e78bff66e93455ddfdc35ad1ea6.exe

    • Size

      654KB

    • MD5

      48df9e78bff66e93455ddfdc35ad1ea6

    • SHA1

      5ad96da90b795a2cc65136a6dfc587b53496eb0a

    • SHA256

      ed6326f78b006f0c6658085f64b1e1aa302578039669b6bb606dcf471bd5defb

    • SHA512

      c3daea047db038e8b51c90d2c2797afa60cbcf6b2541e489536c9673029a2ae6eeceb7f72f89f28ec0579863d332753d1ab4e80501b84e7c154130a751fd5afa

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

    • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern

      suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks