General
-
Target
gunzipped.exe
-
Size
411KB
-
Sample
220106-hqya2sbdck
-
MD5
c2301b62539adcba29dcf6a3200bd017
-
SHA1
fd80f7e8e32661d5ec12e7a901f22a9ed82e17a7
-
SHA256
c30ce79d7b5b0708dc03f1532fa89afd4efd732531cb557dc31fe63acd5bc1ce
-
SHA512
80fef672e7f48640c585f12408025ea06c67344551bb4638e10120ceb30da7e888b18a52aabd209186315c1476da905afe15d5cb68a7d7e266954de16e813037
Static task
static1
Behavioral task
behavioral1
Sample
gunzipped.exe
Resource
win7-en-20211208
Malware Config
Extracted
oski
http://2.56.57.108/osk/
Targets
-
-
Target
gunzipped.exe
-
Size
411KB
-
MD5
c2301b62539adcba29dcf6a3200bd017
-
SHA1
fd80f7e8e32661d5ec12e7a901f22a9ed82e17a7
-
SHA256
c30ce79d7b5b0708dc03f1532fa89afd4efd732531cb557dc31fe63acd5bc1ce
-
SHA512
80fef672e7f48640c585f12408025ea06c67344551bb4638e10120ceb30da7e888b18a52aabd209186315c1476da905afe15d5cb68a7d7e266954de16e813037
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-