oski | a22f28ef4f876cd230e6f5137c3baf87ad63b6bbfa2909c762a358bc75699f5a | Triage

Sharing

General

Target

561b47e434227876ba3657cb681bb31b_JaffaCakes118
Size

404KB
Sample

240718-evcy5avcpl
MD5

561b47e434227876ba3657cb681bb31b
SHA1

c9fb08a81392154fea47389b068cc2c803f229ce
SHA256

a22f28ef4f876cd230e6f5137c3baf87ad63b6bbfa2909c762a358bc75699f5a
SHA512

423e8d34f1bccad81a3f5c445e448a48c89ba4269a97954ab5b016fd7108e8214afe0b031a4244702f7ef30f94bf0de84807735446c25c13ce250b5cd168a81a
SSDEEP

12288:kRuSTDg/kYLfXF62VBTPu7FjpwucdEGe2Ax:kRzT8MeVkFjp1cReF

Score

10^/10

oski infostealer spyware stealer

Malware Config

Extracted

Family

oski

C2

maurizio.ug

Targets

- Target
  
  561b47e434227876ba3657cb681bb31b_JaffaCakes118
- Size
  
  404KB
- MD5
  
  561b47e434227876ba3657cb681bb31b
- SHA1
  
  c9fb08a81392154fea47389b068cc2c803f229ce
- SHA256
  
  a22f28ef4f876cd230e6f5137c3baf87ad63b6bbfa2909c762a358bc75699f5a
- SHA512
  
  423e8d34f1bccad81a3f5c445e448a48c89ba4269a97954ab5b016fd7108e8214afe0b031a4244702f7ef30f94bf0de84807735446c25c13ce250b5cd168a81a
- SSDEEP
  
  12288:kRuSTDg/kYLfXF62VBTPu7FjpwucdEGe2Ax:kRzT8MeVkFjp1cReF
Score

10^/10

oski infostealer spyware stealer
- Oski
  Oski is an infostealer targeting browser data, crypto wallets.
  infostealer oski
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

oskiinfostealerspywarestealer

behavioral2

oskiinfostealerspywarestealer