General

  • Target

    452e6c334e555629c538c4aa6b2adc26_JaffaCakes118

  • Size

    792KB

  • Sample

    241015-b1m5haxcld

  • MD5

    452e6c334e555629c538c4aa6b2adc26

  • SHA1

    f24a31707b2b0037adcc712b0d83541074f909d2

  • SHA256

    44aa270e4c081241057bad8c1d0ea5864087325f8e3209aa10747f108123f718

  • SHA512

    1412c3682f9c0e239743450d7ce86b37e726101f5f1786fe215dfd18c61911f31f13533549c3af2033ce6dbf47dc638466283dca62fd8df062ea2a65e3fd811a

  • SSDEEP

    12288:YcaQxt8LiULbgDPwFVt2NjFhslyAz1+LC6oSU4Acp82cz8/mNMgMRyLcvyQQGSI:NGb0wFVMNjTsl9zwLCZGAa8mqaQeW

Malware Config

Extracted

Family

oski

C2

185.212.131.198/ww/

Targets

    • Target

      452e6c334e555629c538c4aa6b2adc26_JaffaCakes118

    • Size

      792KB

    • MD5

      452e6c334e555629c538c4aa6b2adc26

    • SHA1

      f24a31707b2b0037adcc712b0d83541074f909d2

    • SHA256

      44aa270e4c081241057bad8c1d0ea5864087325f8e3209aa10747f108123f718

    • SHA512

      1412c3682f9c0e239743450d7ce86b37e726101f5f1786fe215dfd18c61911f31f13533549c3af2033ce6dbf47dc638466283dca62fd8df062ea2a65e3fd811a

    • SSDEEP

      12288:YcaQxt8LiULbgDPwFVt2NjFhslyAz1+LC6oSU4Acp82cz8/mNMgMRyLcvyQQGSI:NGb0wFVMNjTsl9zwLCZGAa8mqaQeW

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks