General

  • Target

    1110d573c57860b4ba2719fb17f508b9

  • Size

    712KB

  • Sample

    231230-g78yfacdfk

  • MD5

    1110d573c57860b4ba2719fb17f508b9

  • SHA1

    8212db43ee02260bc150364213c1534b648f1da8

  • SHA256

    83e8782266edec54f4c451f60e2095864c8a9d817e7296076e128c686a6bfea3

  • SHA512

    771ea1f7a769c8d9bc35fb6feab211b8dc0535dd4c5cd0cd335b1116fd4202bbc642727971028471687c91029c621f876c576db55d529093e482e4a10fb4cc36

  • SSDEEP

    12288:en34ViF3zSxwWIQ8VHjuuRImRclE2hao+coM2algtZZES43Tf4Po1yfMa6hVehXm:Ot3zDkijpRubota2ZZqFI

Malware Config

Extracted

Family

oski

C2

try.divendesign.in

Targets

    • Target

      1110d573c57860b4ba2719fb17f508b9

    • Size

      712KB

    • MD5

      1110d573c57860b4ba2719fb17f508b9

    • SHA1

      8212db43ee02260bc150364213c1534b648f1da8

    • SHA256

      83e8782266edec54f4c451f60e2095864c8a9d817e7296076e128c686a6bfea3

    • SHA512

      771ea1f7a769c8d9bc35fb6feab211b8dc0535dd4c5cd0cd335b1116fd4202bbc642727971028471687c91029c621f876c576db55d529093e482e4a10fb4cc36

    • SSDEEP

      12288:en34ViF3zSxwWIQ8VHjuuRImRclE2hao+coM2algtZZES43Tf4Po1yfMa6hVehXm:Ot3zDkijpRubota2ZZqFI

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks