General

  • Target

    887e6a417f06bb6dc94f034935073101

  • Size

    440KB

  • Sample

    231219-yg5lrsfcck

  • MD5

    887e6a417f06bb6dc94f034935073101

  • SHA1

    832bd170fb82f13787f5cb0760da83510259c5ff

  • SHA256

    096274fd9d732efd99db63e588c529184b5e7c27215eb09e6bab705ddfdc7d01

  • SHA512

    e876077cbf778733817c82f5ce144cea000f5677827dad0c2509c35f5dd10cb082243e4f6c31c808a67b45e0d9acca322210935bc8b76b8b9da4e33adc45ca1a

  • SSDEEP

    12288:K2sFVy12lhO0J7l94ZeybVMvaFp94AIACSI737:zsFMolOZleCD9BIAE37

Malware Config

Extracted

Family

oski

C2

agencybro.tech

Targets

    • Target

      887e6a417f06bb6dc94f034935073101

    • Size

      440KB

    • MD5

      887e6a417f06bb6dc94f034935073101

    • SHA1

      832bd170fb82f13787f5cb0760da83510259c5ff

    • SHA256

      096274fd9d732efd99db63e588c529184b5e7c27215eb09e6bab705ddfdc7d01

    • SHA512

      e876077cbf778733817c82f5ce144cea000f5677827dad0c2509c35f5dd10cb082243e4f6c31c808a67b45e0d9acca322210935bc8b76b8b9da4e33adc45ca1a

    • SSDEEP

      12288:K2sFVy12lhO0J7l94ZeybVMvaFp94AIACSI737:zsFMolOZleCD9BIAE37

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks