General

  • Target

    42601ff8d41599bb0a61bed4bddc468c.exe

  • Size

    882KB

  • Sample

    220725-ta25vahbbk

  • MD5

    42601ff8d41599bb0a61bed4bddc468c

  • SHA1

    73ca2dd8e1a2d000447dfc3ea6cd3c84eb7f3490

  • SHA256

    a96d0e16ff2f1bb99d82f6232b48e8d40d879906a0dd2870985359d19e82ff6e

  • SHA512

    011e2c2c5fee106c35cd9a764b37da79f459b6488c5d1ca12f9001666e8d0547d08948f4a7dec219ae5090644f3db87b9817939976e002a55cbf7c4b9665834c

Malware Config

Extracted

Family

oski

C2

ra.adriansbruce.com

Targets

    • Target

      42601ff8d41599bb0a61bed4bddc468c.exe

    • Size

      882KB

    • MD5

      42601ff8d41599bb0a61bed4bddc468c

    • SHA1

      73ca2dd8e1a2d000447dfc3ea6cd3c84eb7f3490

    • SHA256

      a96d0e16ff2f1bb99d82f6232b48e8d40d879906a0dd2870985359d19e82ff6e

    • SHA512

      011e2c2c5fee106c35cd9a764b37da79f459b6488c5d1ca12f9001666e8d0547d08948f4a7dec219ae5090644f3db87b9817939976e002a55cbf7c4b9665834c

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

2
T1005

Tasks