General

  • Target

    a9173de71087efdd86e903af04eb8e2d.bin

  • Size

    118KB

  • Sample

    230811-b8n2rsaa76

  • MD5

    ea3d3cae22cb247829da65a20e1c368f

  • SHA1

    3858dfb10c6975735301c4d811af7ad145b9576e

  • SHA256

    3a864661a90832c69af659cded8fed239d8d157ee2334bdfbab78034e5453ef5

  • SHA512

    8f026b6eedae2f69126fcdfddafb891d445bc560d2def216db3cc8d9ff7f89b82098536e72fe36f9ff739ff42f34228c873c77b449dcf6caef842746b78eaa0f

  • SSDEEP

    3072:NaDwWgM3cnZ4v50ojwlFmM7oZuqYP/KCxZuFewJ:NaDwS6Z4v50ruZuNPyCxZukU

Malware Config

Extracted

Family

oski

C2

de4mon-p4nel.site/oski/

Targets

    • Target

      1214ecff163eb393c89cdf5d4623b40eae8150af6ec578bbb26a535b66af822a.exe

    • Size

      256KB

    • MD5

      a9173de71087efdd86e903af04eb8e2d

    • SHA1

      52c9d2a0b2a930070da73df07de39bf7c2f16691

    • SHA256

      1214ecff163eb393c89cdf5d4623b40eae8150af6ec578bbb26a535b66af822a

    • SHA512

      59cf21fd347ef58682ce084db25d1c2588b1277867c4429234e91221e4e2e234ca0e4de3b0f32d68baded47facd64bfadbd2b4871474d8d16105a53ed3d0aa96

    • SSDEEP

      6144:AfUauY68uSWCx+XA7mg2pNv1LjCei8TI3c:4wY68u1Cx+wm/pP7TI

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

MITRE ATT&CK Enterprise v15

Tasks