oski | c17243e46ff224631e589c55642c3666e5c560715841e8b8ebdd511cb70da8dd | Triage

Sharing

General

Target

e029f21834d5ceea1006d1658768f4dc_JaffaCakes118
Size

514KB
Sample

240406-kfyvyafb73
MD5

e029f21834d5ceea1006d1658768f4dc
SHA1

a4bb6e1e09621536559355cecdb3409f9b7d3ebe
SHA256

c17243e46ff224631e589c55642c3666e5c560715841e8b8ebdd511cb70da8dd
SHA512

8be438a01be27a7e79bc2323fac9b1f586fea4aa7a3db8cf11114b16737530b051b2fa1ce8ba43e4950286b84f27ce3894dec68d2141cf6ecc42b0562a40dc0c
SSDEEP

12288:jIJFd3ilGzEUHt61r+Rnk3GWBdWaj/7+JZvH4r+:edxqKeWGR7+XvN

Score

10^/10

oski infostealer spyware stealer

Malware Config

Extracted

Family

oski

C2

stanelectronics.xyz

Targets

- Target
  
  e029f21834d5ceea1006d1658768f4dc_JaffaCakes118
- Size
  
  514KB
- MD5
  
  e029f21834d5ceea1006d1658768f4dc
- SHA1
  
  a4bb6e1e09621536559355cecdb3409f9b7d3ebe
- SHA256
  
  c17243e46ff224631e589c55642c3666e5c560715841e8b8ebdd511cb70da8dd
- SHA512
  
  8be438a01be27a7e79bc2323fac9b1f586fea4aa7a3db8cf11114b16737530b051b2fa1ce8ba43e4950286b84f27ce3894dec68d2141cf6ecc42b0562a40dc0c
- SSDEEP
  
  12288:jIJFd3ilGzEUHt61r+Rnk3GWBdWaj/7+JZvH4r+:edxqKeWGR7+XvN
Score

10^/10

oski infostealer spyware stealer
- Oski
  Oski is an infostealer targeting browser data, crypto wallets.
  infostealer oski
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

oskiinfostealerspywarestealer

behavioral2

oskiinfostealerspywarestealer