General

  • Target

    01d1c8eefb955c81e49823c2884dbb0d.unknown

  • Size

    1.9MB

  • Sample

    231230-vp44esdbh9

  • MD5

    01d1c8eefb955c81e49823c2884dbb0d

  • SHA1

    0f95257a356e27260cf5867668abb828fef98672

  • SHA256

    e6975dd38703f386f97f8875e92402b91b5e30aa526d1681f9b4541d776ae8da

  • SHA512

    969172e2fb46d4e24a2dfaee0d04946cd5f7f16389781c7ea19365ca82445b02775d2afd17dae81d33677b9c92b3061340bc8bf71ef36d135a15496464eb64d5

  • SSDEEP

    24576:j86mOmxVc5GdjjISb2Wldt7iY2Msaf7oLX9aeU13UkBz0Dmi7pFhPIJUjPeimAUn:Y6C5t2YNTf7FViqYe

Malware Config

Extracted

Language
xlm4.0
Source

Extracted

Family

oski

C2

himarkh.xyz

Targets

    • Target

      PO# HM00050746 13461-001,xls.xll

    • Size

      1.4MB

    • MD5

      a719b4a9d08553ff7683ddcb7003d68b

    • SHA1

      9039d4c0ed993549537bcf365fe35c553bd2ba50

    • SHA256

      fd042d218a6adcb4d496f6d0e9f6fb3dfabdc24bc8bc86681480d76597ec258b

    • SHA512

      74d52ac5dda28962ddceacc7df9da371f56401ef82fbcbc77fc900bb4608574e308eec97b654b1bd781b2ad588ac79daf0166fb10604e0305768aa069f5043c7

    • SSDEEP

      24576:BzbGHAzHAjX1QcLg0jHe6GxAo594f7Byqx90KdI9K9nktTpcA+kukY:BziHICE0j+6GKoj49V989KVCiHlkY

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks