General

  • Target

    1d4bcec84c9d6b5a79b6b3934c59fd9ab91978257352e32f52836eaa86900382

  • Size

    600KB

  • Sample

    230129-y5zenade2x

  • MD5

    fa7aabffc97ed7e5e9560eb8ef6509b4

  • SHA1

    04cb3aaa5c5bc699eb64de6c85600594c879b346

  • SHA256

    1d4bcec84c9d6b5a79b6b3934c59fd9ab91978257352e32f52836eaa86900382

  • SHA512

    53e3698cf8fa45e3345cfd4dade06ffd452811dbde41ebb1699f20e15165e7dac6b67e6ab44ee9795e54560afafc102b96fe4b038d68d48cf591d907349dce64

  • SSDEEP

    12288:LAUsg/zfNZ5KTkExOJm4cojdK2x87yyGOQHcK+gMHdJeXaPh:LAUsgbfdMxOM4ldKQoyWeciMDx

Malware Config

Extracted

Family

oski

C2

odminponel.com

Targets

    • Target

      1d4bcec84c9d6b5a79b6b3934c59fd9ab91978257352e32f52836eaa86900382

    • Size

      600KB

    • MD5

      fa7aabffc97ed7e5e9560eb8ef6509b4

    • SHA1

      04cb3aaa5c5bc699eb64de6c85600594c879b346

    • SHA256

      1d4bcec84c9d6b5a79b6b3934c59fd9ab91978257352e32f52836eaa86900382

    • SHA512

      53e3698cf8fa45e3345cfd4dade06ffd452811dbde41ebb1699f20e15165e7dac6b67e6ab44ee9795e54560afafc102b96fe4b038d68d48cf591d907349dce64

    • SSDEEP

      12288:LAUsg/zfNZ5KTkExOJm4cojdK2x87yyGOQHcK+gMHdJeXaPh:LAUsgbfdMxOM4ldKQoyWeciMDx

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks