General

  • Target

    7f05dc92a62ddd277baaeb55ebcfa407_JaffaCakes118

  • Size

    881KB

  • Sample

    241030-nj3vvatncj

  • MD5

    7f05dc92a62ddd277baaeb55ebcfa407

  • SHA1

    23c8c1a1a8d16180980f4b38a47832738f947141

  • SHA256

    06c8a1e6544aede327bad32a5732d5bcfff143da73da01d34938efbe917e3289

  • SHA512

    3cf46fbbf2e197b15fff65b3250f05add05537e534371ee50c8f0fe6524d4d32717d25ec79c60b8ebd1ed34b99d36522202834ac927fe3e1be5abb7c298768ef

  • SSDEEP

    12288:oplvxon3qGaNHEyC9/oR9gy5ZHK7z1S6TNCTm9H1tVwH9gd0pod3zBts7Vl+YJtm:dPp9AR95SbTIg1Bd4od0+YzR0xz6KV

Malware Config

Extracted

Family

oski

C2

kckark.xyz

Targets

    • Target

      7f05dc92a62ddd277baaeb55ebcfa407_JaffaCakes118

    • Size

      881KB

    • MD5

      7f05dc92a62ddd277baaeb55ebcfa407

    • SHA1

      23c8c1a1a8d16180980f4b38a47832738f947141

    • SHA256

      06c8a1e6544aede327bad32a5732d5bcfff143da73da01d34938efbe917e3289

    • SHA512

      3cf46fbbf2e197b15fff65b3250f05add05537e534371ee50c8f0fe6524d4d32717d25ec79c60b8ebd1ed34b99d36522202834ac927fe3e1be5abb7c298768ef

    • SSDEEP

      12288:oplvxon3qGaNHEyC9/oR9gy5ZHK7z1S6TNCTm9H1tVwH9gd0pod3zBts7Vl+YJtm:dPp9AR95SbTIg1Bd4od0+YzR0xz6KV

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

    • Oski family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks