oski | 44aa270e4c081241057bad8c1d0ea5864087325f8e3209aa10747f108123f718 | Triage

Sharing

General

Target

452e6c334e555629c538c4aa6b2adc26.exe
Size

792KB
Sample

240106-mcmdvadfem
MD5

452e6c334e555629c538c4aa6b2adc26
SHA1

f24a31707b2b0037adcc712b0d83541074f909d2
SHA256

44aa270e4c081241057bad8c1d0ea5864087325f8e3209aa10747f108123f718
SHA512

1412c3682f9c0e239743450d7ce86b37e726101f5f1786fe215dfd18c61911f31f13533549c3af2033ce6dbf47dc638466283dca62fd8df062ea2a65e3fd811a
SSDEEP

12288:YcaQxt8LiULbgDPwFVt2NjFhslyAz1+LC6oSU4Acp82cz8/mNMgMRyLcvyQQGSI:NGb0wFVMNjTsl9zwLCZGAa8mqaQeW

Score

10^/10

oski infostealer

Malware Config

Extracted

Family

oski

C2

185.212.131.198/ww/

Targets

- Target
  
  452e6c334e555629c538c4aa6b2adc26.exe
- Size
  
  792KB
- MD5
  
  452e6c334e555629c538c4aa6b2adc26
- SHA1
  
  f24a31707b2b0037adcc712b0d83541074f909d2
- SHA256
  
  44aa270e4c081241057bad8c1d0ea5864087325f8e3209aa10747f108123f718
- SHA512
  
  1412c3682f9c0e239743450d7ce86b37e726101f5f1786fe215dfd18c61911f31f13533549c3af2033ce6dbf47dc638466283dca62fd8df062ea2a65e3fd811a
- SSDEEP
  
  12288:YcaQxt8LiULbgDPwFVt2NjFhslyAz1+LC6oSU4Acp82cz8/mNMgMRyLcvyQQGSI:NGb0wFVMNjTsl9zwLCZGAa8mqaQeW
Score

10^/10

oski infostealer
- Oski
  Oski is an infostealer targeting browser data, crypto wallets.
  infostealer oski
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

oskiinfostealer

behavioral2