General

  • Target

    93fffc6736b1dd95a4f4e88734e9d540

  • Size

    252KB

  • Sample

    240206-grmp9safdl

  • MD5

    93fffc6736b1dd95a4f4e88734e9d540

  • SHA1

    509a9acffd9b9123fff2a3df9a860b829210f80a

  • SHA256

    80b57df21ba993430e49e63e47f1afd84ac2f64fe50bb0b19413b2f964c42dd0

  • SHA512

    d56d6e46792df1b06449265973e589559ff630ea2bcbcae54ffd0503188477605a63ca4db38f8e5e29d472368902e959f850226cf3ddaa2c0d6ba6ac3b87faed

  • SSDEEP

    6144:vgELakzf1pZVv7cBBn3dELFmAD9/drJnguU9:lj75VcDEpHFJNU9

Malware Config

Extracted

Family

oski

C2

danielmax.ac.ug

Targets

    • Target

      93fffc6736b1dd95a4f4e88734e9d540

    • Size

      252KB

    • MD5

      93fffc6736b1dd95a4f4e88734e9d540

    • SHA1

      509a9acffd9b9123fff2a3df9a860b829210f80a

    • SHA256

      80b57df21ba993430e49e63e47f1afd84ac2f64fe50bb0b19413b2f964c42dd0

    • SHA512

      d56d6e46792df1b06449265973e589559ff630ea2bcbcae54ffd0503188477605a63ca4db38f8e5e29d472368902e959f850226cf3ddaa2c0d6ba6ac3b87faed

    • SSDEEP

      6144:vgELakzf1pZVv7cBBn3dELFmAD9/drJnguU9:lj75VcDEpHFJNU9

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks