General

  • Target

    7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c

  • Size

    502KB

  • Sample

    220524-1zr5hadedp

  • MD5

    73102502f0e548c16c740cbfeb6ce6c9

  • SHA1

    19c33b9d9bbffde348cbf4dcb20005253e020775

  • SHA256

    7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c

  • SHA512

    2636520d7f6500f3631a60d1f56f74546c84a4a34864fbfb2fcf0a5dd29a6565d5ef6c6b1e31e708f9b3cd4fe566fe3924f0f972372f39411ef691f3886c1863

Malware Config

Extracted

Family

oski

C2

k6vq28tbjbz5rhjsgtm3gmsy.xyz

Targets

    • Target

      7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c

    • Size

      502KB

    • MD5

      73102502f0e548c16c740cbfeb6ce6c9

    • SHA1

      19c33b9d9bbffde348cbf4dcb20005253e020775

    • SHA256

      7e1fe76f273a5af1221edea44b386e3c2240d80a0577ef6ed8a1db7cb756c45c

    • SHA512

      2636520d7f6500f3631a60d1f56f74546c84a4a34864fbfb2fcf0a5dd29a6565d5ef6c6b1e31e708f9b3cd4fe566fe3924f0f972372f39411ef691f3886c1863

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks