General

  • Target

    64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517

  • Size

    577KB

  • Sample

    220524-zyrxnscagm

  • MD5

    09f6231385ef6659c6045853e12b5b47

  • SHA1

    b7ce7064240b7993ce3aa0918ddacd8581c9a4c3

  • SHA256

    64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517

  • SHA512

    6aff026b1cf30874a2c0b71fdef8d2dad572998ff75da37608c62c51cf7b093492e123dcda599edf433cc66d14146af49cdca02a0ca76d56da1f5b3813932b59

Malware Config

Extracted

Family

oski

C2

ggtyyu.pw

Targets

    • Target

      64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517

    • Size

      577KB

    • MD5

      09f6231385ef6659c6045853e12b5b47

    • SHA1

      b7ce7064240b7993ce3aa0918ddacd8581c9a4c3

    • SHA256

      64d7ba13bf3e525fc99988f742b751c9df4431af7b26a7d6cdb3191218648517

    • SHA512

      6aff026b1cf30874a2c0b71fdef8d2dad572998ff75da37608c62c51cf7b093492e123dcda599edf433cc66d14146af49cdca02a0ca76d56da1f5b3813932b59

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks