Extracted

• • Target

    Purchase Order.pdf.exe

  • Size

    273KB

  • MD5

    bb5ce7931695bdec6adf8bdc1a674a14

  • SHA1

    ac678662e2dc124111cee4ff9f180b87a8b7f2c0

  • SHA256

    371384518223a80ff5381a728ba1e4f846c93713bb39bc80fb2d95cdd8158241

  • SHA512

    1bde736bcafc95da870d1a51022c03de359d66b65000c50a73a070256b2fc3c971f02d70a029e1e380d544cc85eb6564bba75b2f5ea78aefac42431eabeafe7a

  • SSDEEP

    6144:cVP0JqJ1ped5HIf7SwKCcdo1L6BQgyZVLa0pOxWW6krZKy:u0JqJenHIfnTcdnhyZVLXOwW6ktKy

  Score

  10^/10

  oskidiscoveryinfostealerpersistencespywarestealer

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

    infostealeroski

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2