General

  • Target

    PURCHASE ORDER.pdf.exe

  • Size

    273KB

  • Sample

    220925-2vh7gahfcl

  • MD5

    3304d0b6d7ce20ce511c4a90b76f3a3c

  • SHA1

    88195ea442c55fcf8e735c5525498e0b63107f0c

  • SHA256

    487723e00df8d7f8bfdb57614fa32001f2addc6be9576005b04f1dff53710634

  • SHA512

    130d5f5adbc5bcc4f64116e851249de7271c6ac34f706afe7e2aa9be62bfa680471c17c947806324ed1ab528cec511172f46b86ab2e7134ad4f44c948b286034

  • SSDEEP

    6144:EVP0JqJ1pemf6mr5GRNoQ0kk8MMXSZ7Vl9Fnog3Fpc9QI/3We:m0JqJe46fRNC3qSNf3ndrW/3We

Malware Config

Extracted

Family

oski

C2

� &C

v.oteqprojects.co.in

Targets

    • Target

      PURCHASE ORDER.pdf.exe

    • Size

      273KB

    • MD5

      3304d0b6d7ce20ce511c4a90b76f3a3c

    • SHA1

      88195ea442c55fcf8e735c5525498e0b63107f0c

    • SHA256

      487723e00df8d7f8bfdb57614fa32001f2addc6be9576005b04f1dff53710634

    • SHA512

      130d5f5adbc5bcc4f64116e851249de7271c6ac34f706afe7e2aa9be62bfa680471c17c947806324ed1ab528cec511172f46b86ab2e7134ad4f44c948b286034

    • SSDEEP

      6144:EVP0JqJ1pemf6mr5GRNoQ0kk8MMXSZ7Vl9Fnog3Fpc9QI/3We:m0JqJe46fRNC3qSNf3ndrW/3We

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Defense Evasion

    Execution

      Exfiltration

        Impact

          Initial Access

            Lateral Movement

              Privilege Escalation

                Tasks