Overview

overview

10

Static

static

7

ba9e8e9548...18.exe

windows7_x64

10

ba9e8e9548...18.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ba9e8e95489f6de5529ccd9577a65ac5decaf52900d206ca72d715e8fa4bb918

  • Size

    4.0MB

  • Sample

    220625-g7b9gabfc2

  • MD5

    40e6a0021744f9d32a8522aef538c47a

  • SHA1

    0096c40005e4f19a12f8588357bb512a2cae38a6

  • SHA256

    ba9e8e95489f6de5529ccd9577a65ac5decaf52900d206ca72d715e8fa4bb918

  • SHA512

    5ef067b26eded45b914f0786622224d95c1e22db45dd998b376356e5e981f4d190a0f5a49365ca9ac8b8fcf45edd68350cc10a08fd1cd317d6d295cbfb986377

Score
10/10
oskievasioninfostealerspywarestealerthemidatrojan

Malware Config

Extracted

Family

oski

C2

ratienoinino.pw

Targets

    • Target

      ba9e8e95489f6de5529ccd9577a65ac5decaf52900d206ca72d715e8fa4bb918

    • Size

      4.0MB

    • MD5

      40e6a0021744f9d32a8522aef538c47a

    • SHA1

      0096c40005e4f19a12f8588357bb512a2cae38a6

    • SHA256

      ba9e8e95489f6de5529ccd9577a65ac5decaf52900d206ca72d715e8fa4bb918

    • SHA512

      5ef067b26eded45b914f0786622224d95c1e22db45dd998b376356e5e981f4d190a0f5a49365ca9ac8b8fcf45edd68350cc10a08fd1cd317d6d295cbfb986377

    Score
    10/10
    oskievasioninfostealerspywarestealerthemidatrojan

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

      infostealeroski

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks