Extracted

• • Target
    16e153201be41825d56aaeac47183efd
  • Size 812KB
  • SHA256 930ad6fbbfbac743f4097748a7af399d3fbb61b1ba36bc6230803dcdfb357640
  • MD5 16e153201be41825d56aaeac47183efd
  • SHA1 980367f1702c355961144c8f5cd6444c1f58baa8
  • SHA512 c0c75f37cc18074a29ddb9013692fe903e9d6e6af87210093137352ef5f6f653a4a14adf3799e585117e22b9707a2f9eaf5030e1aa703edbae1c3c641f55616a
  • MD5 SHA1 SHA512

  Score

  10^/10

  oskidiscoveryinfostealerpersistencespywarestealersuricata

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

    infostealeroski

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata

  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    suricata

  • Downloads MZ/PE file

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2