Overview

overview

10

Static

static

3

PURCHASE O...ls.xll

windows7-x64

7

PURCHASE O...ls.xll

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    8871c881e9c6107e9ea7389e47b15a40
  • Size 1.2MB
  • Sample240202-d4e96sfbcq
  • SHA256 fd7a0cea676ea7114f56d5732307f5caf5444c7da5f961066c9289ed5fc766fc
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
oskiinfostealerspywarestealer

Malware Config

Extracted

Language

  • xlm4.0

Source

Extracted

Family

  • oski

C2

  • himarkh.xyz

Targets

    • Target
      PURCHASE ORDER AZAS112.xls.xll
    • Size 880KB
    • SHA256 6c67e1ccf77b872b1f3cf257a257d75c4995dc079945080f578b51357ccdbe55
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    oskiinfostealerspywarestealer

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

      infostealeroski

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks