Overview

overview

10

Static

static

8

74fed62553...38.exe

windows7_x64

10

74fed62553...38.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    74fed62553501ee21a1ec9bfd2e0d3785dec401249c9da3154fbe6b10c713038

  • Size

    1.2MB

  • Sample

    220524-bqxwysehgq

  • MD5

    0040b750f231f0eeb175a48aebab5b48

  • SHA1

    b5446600d2df181c644f9ab582f6d99440727616

  • SHA256

    74fed62553501ee21a1ec9bfd2e0d3785dec401249c9da3154fbe6b10c713038

  • SHA512

    58504c6b4be1c801a68d7d0339254bdf9e49a2ca8865ab7cfb9e7791fe1cf0447ed52ca395b2b160d31f7ab8ea5baff10e60a33dcce708d65b3e896bdd0f5532

Score
10/10
oskiinfostealerspywarestealervmprotect

Malware Config

Targets

    • Target

      74fed62553501ee21a1ec9bfd2e0d3785dec401249c9da3154fbe6b10c713038

    • Size

      1.2MB

    • MD5

      0040b750f231f0eeb175a48aebab5b48

    • SHA1

      b5446600d2df181c644f9ab582f6d99440727616

    • SHA256

      74fed62553501ee21a1ec9bfd2e0d3785dec401249c9da3154fbe6b10c713038

    • SHA512

      58504c6b4be1c801a68d7d0339254bdf9e49a2ca8865ab7cfb9e7791fe1cf0447ed52ca395b2b160d31f7ab8ea5baff10e60a33dcce708d65b3e896bdd0f5532

    Score
    10/10
    oskiinfostealerspywarestealervmprotect

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

      infostealeroski

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks