MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 04739bba7ef80f72f47dd22eb66b9fddb6f48b5c3744b1f9cc6018615aa11bd6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


OskiStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 04739bba7ef80f72f47dd22eb66b9fddb6f48b5c3744b1f9cc6018615aa11bd6
SHA3-384 hash: 9231b12cf5868344bd3872626ae9535147a29cab8ffc0719ebc0b3ee04119b039f00be30887d4d689f8ccdbfd2110290
SHA1 hash: b410b497a791b962e8b9e11b605c291492e542b6
MD5 hash: 24e9df3d16780b449b0ec80f25c263b7
humanhash: pasta-vegan-pennsylvania-twenty
File name:Zguzieszn.exe
Download: download sample
Signature OskiStealer
Create hunting rule
File size:264'504 bytes
First seen:2021-05-07 11:00:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 6144:sjcZRG55tfUeAIQHuA36cdqkgB9F15T50JESKdc5jTY:aXeeAItC66qkgzF7t0Kn4
Threatray 1'148 similar samples on MalwareBazaar
TLSH 2B4402009ADCD71BD5B409366AF5C134FF31AF01AD21E5CB2C1BB29A4731BD1A41DEAA
Reporter starsSk87264403
Tags:OskiStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Zguzieszn.exe
Verdict:
No threats detected
Analysis date:
2021-05-07 07:19:59 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b00b3493-3084-4f0a-beef-4abb740aeeec

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/152615/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.712.11352.30332.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Connection attempt
Deleting a recently created file
Reading critical registry keys
Replacing files
Creating a window
Running batch commands
Creating a process with a hidden window
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Stealing user critical data
Launching a tool to kill processes
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Oski Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/719887
Signature
Creates an undocumented autostart registry key
Downloads files with wrong headers with respect to MIME Content-Type
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Posts data to a JPG file (protocol mismatch)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Oski Stealer
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 408874 Sample: Zguzieszn.exe Startdate: 09/05/2021 Architecture: WINDOWS Score: 100 43 Found malware configuration 2->43 45 Multi AV Scanner detection for dropped file 2->45 47 Multi AV Scanner detection for submitted file 2->47 49 5 other signatures 2->49 8 Zguzieszn.exe 26 2->8         started        process3 file4 25 C:\Users\user\AppData\Roaming\...\notpad.exe, PE32 8->25 dropped 27 C:\Users\user\AppData\Local\...\Zguzieszn.exe, PE32 8->27 dropped 29 C:\Users\...\Zguzieszn.exe:Zone.Identifier, ASCII 8->29 dropped 31 C:\Users\user\AppData\...\Zguzieszn.exe.log, ASCII 8->31 dropped 51 Creates an undocumented autostart registry key 8->51 12 Zguzieszn.exe 193 8->12         started        17 BackgroundTransferHost.exe 13 8->17         started        signatures5 process6 dnsIp7 41 198.98.49.140, 49728, 80 PONYNETUS United States 12->41 33 C:\ProgramData\vcruntime140.dll, PE32 12->33 dropped 35 C:\ProgramData\sqlite3.dll, PE32 12->35 dropped 37 C:\ProgramData\softokn3.dll, PE32 12->37 dropped 39 4 other files (none is malicious) 12->39 dropped 53 Multi AV Scanner detection for dropped file 12->53 55 Tries to harvest and steal browser information (history, passwords, etc) 12->55 57 Tries to steal Crypto Currency Wallets 12->57 19 cmd.exe 1 17->19         started        file8 signatures9 process10 process11 21 taskkill.exe 1 19->21         started        23 conhost.exe 19->23         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/04739bba7ef80f72f47dd22eb66b9fddb6f48b5c3744b1f9cc6018615aa11bd6/
Threat name:
ByteCode-MSIL.Trojan.Tnega
Create hunting rule
Status:
Malicious
First seen:
2021-05-06 12:46:36 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=arzzxot67ahxf5d52ixlm2473w3pjc24g5cld6ommamgcwvbdpla._file
Verdict:
malicious
Similar samples:
0768e83e8d36f21ea90867dcf3935ee48795daf2e4a0017979e752b865c95d9e
OskiStealer
1860347130f68ba0d084750816ca0fc532b8647d89e36ff53c0355e73a46d332
OskiStealer
37f96df377557cad9bdb2caa4064bbf4dd862e935a64e1d802d445358695e15c
OskiStealer
3aeccf51ec935646a4987a1683d5dd8a251d171d326041282759753e371dff4f
OskiStealer
604e8bce3d31f5e04fe9622cedeb0696a69b9cb7f262a9bb33009ede20df100a
OskiStealer
916bd03b40de6bfa498311e3a70d3e98c50e8255fd413d446daab77951224856
OskiStealer
9b26547086a1489e5534452021694af3a565fe76926e671112be4852947a5d27
OskiStealer
b2454961c84e927b086719e0bae8016bee823e17402fb0feca8bda4e63ff009c
OskiStealer
cb24694242c1c1618678711184ab8abe6a1335d348f3549d2b568d99f793bf28
OskiStealer
db127ccf5ea69c0bc3888efe5ae2a532c5f5590a2f589f049139fcf63f5e8062
OskiStealer
+ 1'138 additional samples on MalwareBazaar
Result
Malware family:
oski
Create hunting rule
Score:
  10/10
Tags:
family:oski discovery infostealer spyware stealer
Link:
https://tria.ge/reports/210507-pn8w7hg3qn/
Behaviour
Checks processor information in registry
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Oski
Malware Config
C2 Extraction:
198.98.49.140
Unpacked files
SH256 hash:
5a92c5aab95e4927d15b02c7d60e0fbe5421059f8ab8ebd48b67576252e692c0
MD5 hash:
e057441471a377e014a3c62b9ca58ee3
SHA1 hash:
102e6cf22251581b7a7c763f0f493dfb5a517957
Link:
https://www.unpac.me/results/0fc3fb42-d0c5-4bca-93eb-54befe96f2f9/
SH256 hash:
eb8ddbbbc61c4780a1cab2c48c8e8684a53f851defebfd30a9415ba8df32c273
MD5 hash:
71b51d4a0ffae818f66fd933ceb99a49
SHA1 hash:
75600afacce18f0e549146d2cd7e5fa01787e4fb
Link:
https://www.unpac.me/results/0fc3fb42-d0c5-4bca-93eb-54befe96f2f9/
SH256 hash:
188bd0ae605d3cb14279b9fc4c3dbcc8619e96eddc8ab1743c716d7dbae73466
MD5 hash:
bfa60af37152184aa9ab35927cdbfd54
SHA1 hash:
9fb2c87c10f850f76bf37200cbe96aa72f52fe89
Detections:
win_oski_g0
Create hunting rule
win_oski_auto
Create hunting rule
Link:
https://www.unpac.me/results/0fc3fb42-d0c5-4bca-93eb-54befe96f2f9/
Parent samples :
5e90997364ac5c40a3c374faa4a11c74e9d040e42c10a2dcab169818e1d717b5
04739bba7ef80f72f47dd22eb66b9fddb6f48b5c3744b1f9cc6018615aa11bd6
SH256 hash:
04739bba7ef80f72f47dd22eb66b9fddb6f48b5c3744b1f9cc6018615aa11bd6
MD5 hash:
24e9df3d16780b449b0ec80f25c263b7
SHA1 hash:
b410b497a791b962e8b9e11b605c291492e542b6
Link:
https://www.unpac.me/results/0fc3fb42-d0c5-4bca-93eb-54befe96f2f9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/04739bba7ef80f72f47dd22eb66b9fddb6f48b5c3744b1f9cc6018615aa11bd6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:dsc
Create hunting rule
Author:Aaron DeVera
Description:Discord domains
Rule name:INDICATOR_KB_CERT_04f131322cc31d92c849fca351d2f141
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates
Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload
Rule name:win_oski_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

OskiStealer

Executable exe 04739bba7ef80f72f47dd22eb66b9fddb6f48b5c3744b1f9cc6018615aa11bd6

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/152615/
  
URLhaus
https://urlhaus.abuse.ch/url/1203548/
  
Delivery method
Distributed via web download

Comments