General

  • Target

    a719b4a9d08553ff7683ddcb7003d68b

  • Size

    1.4MB

  • Sample

    240226-xmz3ssdc93

  • MD5

    a719b4a9d08553ff7683ddcb7003d68b

  • SHA1

    9039d4c0ed993549537bcf365fe35c553bd2ba50

  • SHA256

    fd042d218a6adcb4d496f6d0e9f6fb3dfabdc24bc8bc86681480d76597ec258b

  • SHA512

    74d52ac5dda28962ddceacc7df9da371f56401ef82fbcbc77fc900bb4608574e308eec97b654b1bd781b2ad588ac79daf0166fb10604e0305768aa069f5043c7

  • SSDEEP

    24576:BzbGHAzHAjX1QcLg0jHe6GxAo594f7Byqx90KdI9K9nktTpcA+kukY:BziHICE0j+6GKoj49V989KVCiHlkY

Malware Config

Extracted

Language
xlm4.0
Source

Extracted

Family

oski

C2

himarkh.xyz

Targets

    • Target

      a719b4a9d08553ff7683ddcb7003d68b

    • Size

      1.4MB

    • MD5

      a719b4a9d08553ff7683ddcb7003d68b

    • SHA1

      9039d4c0ed993549537bcf365fe35c553bd2ba50

    • SHA256

      fd042d218a6adcb4d496f6d0e9f6fb3dfabdc24bc8bc86681480d76597ec258b

    • SHA512

      74d52ac5dda28962ddceacc7df9da371f56401ef82fbcbc77fc900bb4608574e308eec97b654b1bd781b2ad588ac79daf0166fb10604e0305768aa069f5043c7

    • SSDEEP

      24576:BzbGHAzHAjX1QcLg0jHe6GxAo594f7Byqx90KdI9K9nktTpcA+kukY:BziHICE0j+6GKoj49V989KVCiHlkY

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks