General

  • Target

    92d6baf79e990130a1db2175731d4e46

  • Size

    686KB

  • Sample

    240205-ygkllafbd8

  • MD5

    92d6baf79e990130a1db2175731d4e46

  • SHA1

    db9efd2c26760ce555c1c31ca8d80d1731b26771

  • SHA256

    d9fa9a6d2f94da43ceb1e54df2cac4e099d6700ad52db757e5cbbece821e73d9

  • SHA512

    c0a377d978f2e32af07abc8b0faa046e53c96e0c10c1333f9fd3ba43a6414a22df1cdc74d4335cdd063393d785ca50d1b0f53f448a7fd26565031ede20c4db6a

  • SSDEEP

    12288:PsIi50Ynk0H5sQH0YDMr1se/fRlA6EiNxcBO3XF02kLxEz33n5+mEJqyOx4:PtiKY/OQUwekXCcBmF3WS3Jta7O4

Malware Config

Extracted

Family

oski

C2

ck7.mooo.com

Targets

    • Target

      92d6baf79e990130a1db2175731d4e46

    • Size

      686KB

    • MD5

      92d6baf79e990130a1db2175731d4e46

    • SHA1

      db9efd2c26760ce555c1c31ca8d80d1731b26771

    • SHA256

      d9fa9a6d2f94da43ceb1e54df2cac4e099d6700ad52db757e5cbbece821e73d9

    • SHA512

      c0a377d978f2e32af07abc8b0faa046e53c96e0c10c1333f9fd3ba43a6414a22df1cdc74d4335cdd063393d785ca50d1b0f53f448a7fd26565031ede20c4db6a

    • SSDEEP

      12288:PsIi50Ynk0H5sQH0YDMr1se/fRlA6EiNxcBO3XF02kLxEz33n5+mEJqyOx4:PtiKY/OQUwekXCcBmF3WS3Jta7O4

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks