General

  • Target

    5cd0759c1e566b6e74ef3f29a49a34a08ded2dc44408fccd41b5a9845573a34c.zip

  • Size

    351KB

  • Sample

    240811-myteaawenl

  • MD5

    8c7a6ef2ab42f269605f1fac4e563fe8

  • SHA1

    b306a9ed4ab13ce394b403789c9e12d116e99cde

  • SHA256

    0c16b33ea06e3c929fdae5e8938d711779aa6a7b9a783edf40364c9cac06d003

  • SHA512

    77570372cd789f099e42f86104a96d3ae08b6b463b6153f57b97587e869978cda297055ec79fcf4b33b0112fb32afbc3bfba9bfdbae47e4eda9e3da5def7ebb0

  • SSDEEP

    6144:zeot71AwylA3K1RRv04+U+R+GhtIXBBYDZIv8aAPZ8CjnUSuA+GPKUS9ywMWP2Vg:zr7Wwf3UReXhKXBiZIEqCnkA+EZPwd2W

Malware Config

Extracted

Family

oski

C2

himarkh.xyz

Targets

    • Target

      5cd0759c1e566b6e74ef3f29a49a34a08ded2dc44408fccd41b5a9845573a34c.exe

    • Size

      680KB

    • MD5

      bc7f80814ad63a035fbf8e0b67b02155

    • SHA1

      a7d76dd02b12bb250f9f42101fda1fa235154710

    • SHA256

      5cd0759c1e566b6e74ef3f29a49a34a08ded2dc44408fccd41b5a9845573a34c

    • SHA512

      ac336b61ad93d51e68784350d59d56d08ac947426c3570ed7f0dfbbbdfce24bd0c495c6f626d3edeb8de47a0f0a3a09701b33b78dbb7a7a1e0b1cd32f8d0991a

    • SSDEEP

      6144:nSiQrg69p5Ozn2zdCQ2I8EXAOteqM+Z4q6NHnfmDZET62KGUXtkJwov56hL:eBIzn2zd6EX6qM+Z4qufG6/PUyJw+A

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks