oski | a9173de71087efdd86e903af04eb8e2d[.]bin

General

Target
a9173de71087efdd86e903af04eb8e2d.bin
Size 118KB
Sample230811-b8n2rsaa76
SHA256 3a864661a90832c69af659cded8fed239d8d157ee2334bdfbab78034e5453ef5
MD5 ea3d3cae22cb247829da65a20e1c368f
SHA1 3858dfb10c6975735301c4d811af7ad145b9576e
SHA512 8f026b6eedae2f69126fcdfddafb891d445bc560d2def216db3cc8d9ff7f89b82098536e72fe36f9ff739ff42f34228c873c77b449dcf6caef842746b78eaa0f
SSDEEP 3072:NaDwWgM3cnZ4v50ojwlFmM7oZuqYP/KCxZuFewJ:NaDwS6Z4v50ruZuNPyCxZukU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

oski

Malware Config

Extracted

Family

oski

C2

de4mon-p4nel.site/oski/

Signatures

Oski family
oski

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/1214ecff163eb393c89cdf5d4623b40eae8150af6ec578bbb26a535b66af822a.exe

File Explorer

a9173de71087efdd86e903af04eb8e2d.bin

.zip 118KB
1214ecff163eb393c89cdf5d4623b40eae8150af6ec578bbb26a535b66af822a.exe

.exe 256KB

a9173de71087efdd86e903af04eb8e2d.bin

SHA256 3a864661a90832c69af659cded8fed239d8d157ee2334bdfbab78034e5453ef5
MD5 ea3d3cae22cb247829da65a20e1c368f
SHA1 3858dfb10c6975735301c4d811af7ad145b9576e
SHA512 8f026b6eedae2f69126fcdfddafb891d445bc560d2def216db3cc8d9ff7f89b82098536e72fe36f9ff739ff42f34228c873c77b449dcf6caef842746b78eaa0f
SSDEEP 3072:NaDwWgM3cnZ4v50ojwlFmM7oZuqYP/KCxZuFewJ:NaDwS6Z4v50ruZuNPyCxZukU
MD5 SHA1 SHA512 SSDEEP

Password

infected

1214ecff163eb393c89cdf5d4623b40eae8150af6ec578bbb26a535b66af822a.exe

IMPHASH 7bb9d345a5fec4fbbf5100d6a3ffbb8c
SHA256 1214ecff163eb393c89cdf5d4623b40eae8150af6ec578bbb26a535b66af822a
MD5 a9173de71087efdd86e903af04eb8e2d
SHA1 52c9d2a0b2a930070da73df07de39bf7c2f16691
SHA512 59cf21fd347ef58682ce084db25d1c2588b1277867c4429234e91221e4e2e234ca0e4de3b0f32d68baded47facd64bfadbd2b4871474d8d16105a53ed3d0aa96
SSDEEP 6144:AfUauY68uSWCx+XA7mg2pNv1LjCei8TI3c:4wY68u1Cx+wm/pP7TI
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

29051

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapAlloc GetProcessHeap CreateFileA GetFileSize WriteFile ReadFile MultiByteToWideChar CloseHandle GetFullPathNameW FindFirstFileExW FindClose FindNextFileW LocalAlloc GetVersionExA LocalFree Sleep GlobalMemoryStatus GetFileAttributesA SetFilePointer MapViewOfFile UnmapViewOfFile SystemTimeToFileTime GetTickCount FileTimeToSystemTime GetLocalTime CreateFileMappingA GetFileInformationByHandle WriteConsoleW SetEndOfFile FlushFileBuffers GetConsoleMode GetConsoleCP SetStdHandle FileTimeToLocalFileTime GetLastError FindFirstFileExA FindNextFileA EncodePointer DecodePointer HeapFree WideCharToMultiByte GetSystemTimeAsFileTime GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetCurrentThreadId GetProcAddress HeapSize ExitProcess HeapCreate GetStdHandle GetModuleFileNameW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount RtlUnwind SetHandleCount GetFileType DeleteCriticalSection SetEnvironmentVariableW SetEnvironmentVariableA GetTimeZoneInformation LCMapStringW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCurrentProcessId GetStringTypeW HeapReAlloc LoadLibraryW CompareStringW CreateFileW

user32

GetDesktopWindow

netapi32

NetWkstaGetInfo NetApiBufferFree DsRoleGetPrimaryDomainInformation

Sharing