General

  • Target

    346c100e2273e74eb8c0c392cabc26ab.exe

  • Size

    200KB

  • Sample

    220929-zapseachaq

  • MD5

    346c100e2273e74eb8c0c392cabc26ab

  • SHA1

    0da212b33075ba1b28bd3cf9b249fd777479dfa7

  • SHA256

    8f76bcae1d2fb6e2d36e29045207de4cc6fbb7387de52b47f0751db8a3ff760b

  • SHA512

    83d7b7a9da01d93f8a4466d0e9b2aea32c9ec756108e3a49253411840e84403bd4f0fd43da84666a92b0e0b61dcc16204a1f260fbbce34cc4f0b9ae0b32f5ab6

  • SSDEEP

    3072:WfUomEuYm98dlSq7gt5q7Dx+XgS6aCEwhOfUbCalNT2pbB3fIs1Xi6FLPo3c:WfUauY68uSWCx+XA7mg2pNZ1Ljo3c

Malware Config

Extracted

Family

oski

C2

gilvantur.com/site/bot/

Targets

    • Target

      346c100e2273e74eb8c0c392cabc26ab.exe

    • Size

      200KB

    • MD5

      346c100e2273e74eb8c0c392cabc26ab

    • SHA1

      0da212b33075ba1b28bd3cf9b249fd777479dfa7

    • SHA256

      8f76bcae1d2fb6e2d36e29045207de4cc6fbb7387de52b47f0751db8a3ff760b

    • SHA512

      83d7b7a9da01d93f8a4466d0e9b2aea32c9ec756108e3a49253411840e84403bd4f0fd43da84666a92b0e0b61dcc16204a1f260fbbce34cc4f0b9ae0b32f5ab6

    • SSDEEP

      3072:WfUomEuYm98dlSq7gt5q7Dx+XgS6aCEwhOfUbCalNT2pbB3fIs1Xi6FLPo3c:WfUauY68uSWCx+XA7mg2pNZ1Ljo3c

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

2
T1005

Tasks