MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12f5634cd28b25f6dcde9a1d7902d64ab4ded48b50e06e4ec0f583e03a156125. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


OskiStealer


Vendor detections: 11


Intelligence 11 IOCs 7 YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 12f5634cd28b25f6dcde9a1d7902d64ab4ded48b50e06e4ec0f583e03a156125
SHA3-384 hash: 00c0d4dd725813aebd24df942ca16ccda8c4ca8153e7afd8c9ed4246f70ce1f80fc96d6840f607fc22da2fc6ddfd4e12
SHA1 hash: 5471613428b0278008c0fe43143d3116a3daf4ee
MD5 hash: b93fea20ae6475a7b2c9284812171a31
humanhash: fanta-illinois-orange-eleven
File name:B93FEA20AE6475A7B2C9284812171A31.exe
Download: download sample
Signature OskiStealer
Create hunting rule
File size:524'800 bytes
First seen:2021-06-22 13:16:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:9UvzHXGQvdQdMXZPPFqqjBgiLiHHEov9GkUnYs7xNEzMqArhyTcbQOnIfLO7DWTN:90HXGUudMxBgphlyYs78EhyTPO26yqI
Threatray 1'557 similar samples on MalwareBazaar
TLSH 3FB4087815F85C45CABF157ED98F0260E2B97518AE53413F6A70A214A82377F8C329FE
Reporter abuse_ch
Tags:exe OskiStealer


Avatar
abuse_ch
OskiStealer C2:
http://bradaltman.com/6.jpg

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://bradaltman.com/6.jpg https://threatfox.abuse.ch/ioc/139920/
http://bradaltman.com/1.jpg https://threatfox.abuse.ch/ioc/139921/
http://bradaltman.com/2.jpg https://threatfox.abuse.ch/ioc/139922/
http://bradaltman.com/3.jpg https://threatfox.abuse.ch/ioc/139923/
http://bradaltman.com/4.jpg https://threatfox.abuse.ch/ioc/139924/
http://bradaltman.com/5.jpg https://threatfox.abuse.ch/ioc/139925/
http://bradaltman.com/7.jpg https://threatfox.abuse.ch/ioc/139926/

Intelligence

File Origin
# of uploads :
1
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
B93FEA20AE6475A7B2C9284812171A31.exe
Verdict:
Malicious activity
Analysis date:
2021-06-22 13:23:05 UTC
Tags:
trojan stealer vidar loader
Link:
https://app.any.run/tasks/be8454ec-d682-4807-a1d3-eb57a2c02d13

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/167567/
Detection(s):
SecuriteInfo.com.Variant.Adware.BrowseFox.62.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Oski Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7b927619-b258-4302-9a1e-25401ac4de3b
Result
Threat name:
Oski Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/805966
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Downloads files with wrong headers with respect to MIME Content-Type
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Posts data to a JPG file (protocol mismatch)
Tries to evade analysis by execution special instruction which cause usermode exception
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Oski Stealer
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 438378 Sample: FidKy67SWO.exe Startdate: 22/06/2021 Architecture: WINDOWS Score: 100 66 Found malware configuration 2->66 68 Antivirus / Scanner detection for submitted sample 2->68 70 Multi AV Scanner detection for submitted file 2->70 72 6 other signatures 2->72 8 ZmFSAqsNCM.exe 1 2->8         started        11 FidKy67SWO.exe 1 4 2->11         started        14 ZmFSAqsNCM.exe 2->14         started        process3 file4 74 Antivirus detection for dropped file 8->74 76 Multi AV Scanner detection for dropped file 8->76 78 Machine Learning detection for dropped file 8->78 16 ZmFSAqsNCM.exe 193 8->16         started        20 ZmFSAqsNCM.exe 8->20         started        52 C:\Users\user\AppData\...\ZmFSAqsNCM.exe, PE32 11->52 dropped 54 C:\Users\...\ZmFSAqsNCM.exe:Zone.Identifier, ASCII 11->54 dropped 56 C:\Users\user\AppData\...\FidKy67SWO.exe.log, ASCII 11->56 dropped 80 Injects a PE file into a foreign processes 11->80 22 FidKy67SWO.exe 193 11->22         started        24 FidKy67SWO.exe 11->24         started        26 ZmFSAqsNCM.exe 14->26         started        signatures5 process6 dnsIp7 60 Tries to steal Crypto Currency Wallets 16->60 29 cmd.exe 16->29         started        58 bradaltman.com 192.254.185.252, 49718, 49724, 49728 UNIFIEDLAYER-AS-1US United States 22->58 31 cmd.exe 1 22->31         started        44 C:\ProgramData\vcruntime140.dll, PE32 26->44 dropped 46 C:\ProgramData\sqlite3.dll, PE32 26->46 dropped 48 C:\ProgramData\softokn3.dll, PE32 26->48 dropped 50 4 other files (none is malicious) 26->50 dropped 62 Tries to harvest and steal browser information (history, passwords, etc) 26->62 33 WerFault.exe 26->33         started        file8 signatures9 process10 signatures11 36 conhost.exe 29->36         started        38 taskkill.exe 29->38         started        40 taskkill.exe 1 31->40         started        42 conhost.exe 31->42         started        64 Tries to evade analysis by execution special instruction which cause usermode exception 33->64 process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/12f5634cd28b25f6dcde9a1d7902d64ab4ded48b50e06e4ec0f583e03a156125/
Threat name:
Win32.Trojan.Barys
Create hunting rule
Status:
Malicious
First seen:
2021-06-18 23:03:07 UTC
AV detection:
25 of 45 (55.56%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cl2wgtgsrms7nxg6tioxsawwjk2n5velkdqg4twa6wb6aoqvmesq._file
Verdict:
malicious
Similar samples:
0768e83e8d36f21ea90867dcf3935ee48795daf2e4a0017979e752b865c95d9e
OskiStealer
1860347130f68ba0d084750816ca0fc532b8647d89e36ff53c0355e73a46d332
OskiStealer
37f96df377557cad9bdb2caa4064bbf4dd862e935a64e1d802d445358695e15c
OskiStealer
3aeccf51ec935646a4987a1683d5dd8a251d171d326041282759753e371dff4f
OskiStealer
604e8bce3d31f5e04fe9622cedeb0696a69b9cb7f262a9bb33009ede20df100a
OskiStealer
916bd03b40de6bfa498311e3a70d3e98c50e8255fd413d446daab77951224856
OskiStealer
9b26547086a1489e5534452021694af3a565fe76926e671112be4852947a5d27
OskiStealer
c41aa6d6eeac57851b0a00a619609ed764072881b85b7dad25ac30f2856eda43
OskiStealer
cb24694242c1c1618678711184ab8abe6a1335d348f3549d2b568d99f793bf28
OskiStealer
db127ccf5ea69c0bc3888efe5ae2a532c5f5590a2f589f049139fcf63f5e8062
OskiStealer
+ 1'547 additional samples on MalwareBazaar
Result
Malware family:
oski
Create hunting rule
Score:
  10/10
Tags:
family:oski discovery infostealer persistence spyware stealer
Link:
https://tria.ge/reports/210622-wt4nkykyna/
Behaviour
Checks processor information in registry
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Oski
Malware Config
C2 Extraction:
bradaltman.com
Unpacked files
SH256 hash:
97837b92791164ecd7e4f002b3e723b6490b21082cf0c2ef62dd6dff9d6d36b6
MD5 hash:
e75ffb778696dd354cf891fd82f98ba7
SHA1 hash:
6f3c22bda013c8f2e01912c4c10412cf6333d5b8
Detections:
win_oski_g0
Create hunting rule
win_oski_auto
Create hunting rule
Link:
https://www.unpac.me/results/4c842e1b-7ab9-4cc4-b2ae-1d1c59e5b054/
SH256 hash:
2cd3672690c275fd95fa08adaca47e14e7814aae6202b7820358b0d65fa04f59
MD5 hash:
b2e403007482e30996825899e92058e1
SHA1 hash:
464b538b12daaa3d0dd3bbd1cf8b3ddfde5af5ed
Link:
https://www.unpac.me/results/4c842e1b-7ab9-4cc4-b2ae-1d1c59e5b054/
SH256 hash:
79243bc7d5809322d4bb6286496db1711b239a17cfacfb158c6a6e5b91e57bb5
MD5 hash:
67e49231a7da6e0665d2b6510f7932f8
SHA1 hash:
22fba7336a9a804b0607c5a05e708ac753f5f4cb
Link:
https://www.unpac.me/results/4c842e1b-7ab9-4cc4-b2ae-1d1c59e5b054/
SH256 hash:
12f5634cd28b25f6dcde9a1d7902d64ab4ded48b50e06e4ec0f583e03a156125
MD5 hash:
b93fea20ae6475a7b2c9284812171a31
SHA1 hash:
5471613428b0278008c0fe43143d3116a3daf4ee
Link:
https://www.unpac.me/results/4c842e1b-7ab9-4cc4-b2ae-1d1c59e5b054/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/12f5634cd28b25f6dcde9a1d7902d64ab4ded48b50e06e4ec0f583e03a156125

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload
Rule name:win_oski_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_oski_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/167567/

Comments