General

  • Target

    08404813f0e11c3688b525e090dab33d7468c87a9b0e9beae61364b53f28540c

  • Size

    351KB

  • Sample

    240417-q534vaae54

  • MD5

    0fee68103e9779b1e896519400b66b3c

  • SHA1

    697a4d8c6bed46f748ccaf238f7a5790fab14eb4

  • SHA256

    08404813f0e11c3688b525e090dab33d7468c87a9b0e9beae61364b53f28540c

  • SHA512

    c63280b80a6470187206da314832ccd1fea8ade353ed8b0f4b40b79894a8daa1f4d099d7e51ad20a0e298e5149a455a9ad816ace1146e5db4d398bf82fa40686

  • SSDEEP

    6144:lkzL9ZhRyhJqdeZq8RKykimKl4og9Y4Wh4GU5p1yDvLGpIfv9DjCaoI1j7F1H6u1:QL9RWWQkiZpg9ZWh4tpmTGyHRjEMjJ17

Malware Config

Extracted

Family

oski

C2

himarkh.xyz

Targets

    • Target

      5cd0759c1e566b6e74ef3f29a49a34a08ded2dc44408fccd41b5a9845573a34c.exe

    • Size

      680KB

    • MD5

      bc7f80814ad63a035fbf8e0b67b02155

    • SHA1

      a7d76dd02b12bb250f9f42101fda1fa235154710

    • SHA256

      5cd0759c1e566b6e74ef3f29a49a34a08ded2dc44408fccd41b5a9845573a34c

    • SHA512

      ac336b61ad93d51e68784350d59d56d08ac947426c3570ed7f0dfbbbdfce24bd0c495c6f626d3edeb8de47a0f0a3a09701b33b78dbb7a7a1e0b1cd32f8d0991a

    • SSDEEP

      6144:nSiQrg69p5Ozn2zdCQ2I8EXAOteqM+Z4q6NHnfmDZET62KGUXtkJwov56hL:eBIzn2zd6EX6qM+Z4qufG6/PUyJw+A

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks