Extracted

• • Target

    e105e4778abd8cc1d35e0d6b1f0ad17994570ead16764f012270be94de740aaf.exe

  • Size

    1.2MB

  • MD5

    c361fe1dc05f5d90c1ce35e0d49b6338

  • SHA1

    267aac6007a22ca4c17eabbfe4c71f3194b181d6

  • SHA256

    e105e4778abd8cc1d35e0d6b1f0ad17994570ead16764f012270be94de740aaf

  • SHA512

    a1f7a311e03af563d43a2f2d3820d6ac690c99f0edd0ae935df2018205b6e970d14017dd043fd22bc24e956ea483a21116fa1e5b5be4152d3d266a51b9c9d55e

  • SSDEEP

    24576:qQ+JBjAObi4M2rIDTU4fmj6J/d5nTWzim9W7akhWFhepaLSbK:qQGBfbiyrIDovj6l+59W7aApat

  Score

  10^/10

  defense_evasiondiscoverypersistenceoskiinfostealer

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

    infostealeroski

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2