Extracted

• • Target
    Gatdhaozmwzqbfqrwgmuappjkqvltpfcxj.exe
  • Size 713KB
  • SHA256 e65c6e141516a7d76fe7c1e3bcc5433758fa627dfd6c18f65504efcfa62d4855
  • MD5 5d8d890614b10708afe877fb67a3e65b
  • SHA1 102b326899fbb5a2e6c03fcfb8e401c5c3a72f78
  • SHA512 79aa96244be4450cefce26a206e61365b23db218adcaab4c70be7ac8e33e9eb3d4642c5fddf96133e721d6333eb1fb67181b8269a4f824a4aecc8b2112cb5842
  • MD5 SHA1 SHA512

  Score

  10^/10

  oskidiscoveryinfostealerpersistencespywarestealersuricata

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

    infostealeroski

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata

  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    suricata

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2