Overview

overview

10

Static

static

18719D6856...AD.exe

windows7_x64

10

18719D6856...AD.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18719D6856A09A622001F1C325067D56AFA63BD21FBAD.exe

  • Size

    867KB

  • Sample

    220114-pz9h1agbh9

  • MD5

    39bfd2ce7cffeafc8f4d85d89fd6f072

  • SHA1

    9d0df13ef8de579a2bbfba88e938a836ffab1069

  • SHA256

    18719d6856a09a622001f1c325067d56afa63bd21fbad25fd23c01b2c0c67472

  • SHA512

    d2e4b81133cb427a52ba10cbde23ea16ed33dc0c57affc55afa0ca5bbf68e03841e258ca153c5f217fe0f4f483f3705882eb556718f9c98f508db7144b7b51bb

Score
10/10
oskistormkittycollectioninfostealerpersistencespywarestealervmprotect

Malware Config

Extracted

Family

oski

C2

pplonline.org/Cgi/

Targets

    • Target

      18719D6856A09A622001F1C325067D56AFA63BD21FBAD.exe

    • Size

      867KB

    • MD5

      39bfd2ce7cffeafc8f4d85d89fd6f072

    • SHA1

      9d0df13ef8de579a2bbfba88e938a836ffab1069

    • SHA256

      18719d6856a09a622001f1c325067d56afa63bd21fbad25fd23c01b2c0c67472

    • SHA512

      d2e4b81133cb427a52ba10cbde23ea16ed33dc0c57affc55afa0ca5bbf68e03841e258ca153c5f217fe0f4f483f3705882eb556718f9c98f508db7144b7b51bb

    Score
    10/10
    oskistormkittyinfostealerpersistencespywarestealervmprotectcollection

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

      infostealeroski

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty Payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks