MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 192f884438809d6fb01ae0c89c4ccd1fdae62d429e78bdbcc4ff4d28a54049af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


OskiStealer


Vendor detections: 11


Intelligence 11 IOCs 7 YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 192f884438809d6fb01ae0c89c4ccd1fdae62d429e78bdbcc4ff4d28a54049af
SHA3-384 hash: 14e68a777752a5c29734f354a3b5519102aafa03cb0fee72549a8c279b3baaf09ffb3adbd80bd453f978ccfab3551951
SHA1 hash: 7d45cf3ded4de7432aaeaac18937e13e567d4e81
MD5 hash: 2ed2d26ee75e5bc46a355c0265dd4719
humanhash: pizza-magnesium-purple-high
File name:PO294232.exe
Download: download sample
Signature OskiStealer
Create hunting rule
File size:550'912 bytes
First seen:2021-10-27 08:21:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 6144:FY6cY4hwuImLrfqldGybMwOowIeSb0EnSxuU56b2oqHJy/W0THQW4+PsVKcz1IHF:4b1ImHEowOoAkHjSDpD0QVWMQ
Threatray 3'942 similar samples on MalwareBazaar
TLSH T11AC4D05167B8C84AC67907B0D4B4C0F04772BC16D612E60F99D63CDF3A72782962AB6F
Reporter abuse_ch
Tags:exe OskiStealer


Avatar
abuse_ch
OskiStealer C2:
http://bakas1e.xyz/6.jpg

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://bakas1e.xyz/6.jpg https://threatfox.abuse.ch/ioc/237964/
http://bakas1e.xyz/1.jpg https://threatfox.abuse.ch/ioc/237965/
http://bakas1e.xyz/2.jpg https://threatfox.abuse.ch/ioc/237966/
http://bakas1e.xyz/3.jpg https://threatfox.abuse.ch/ioc/237967/
http://bakas1e.xyz/4.jpg https://threatfox.abuse.ch/ioc/237968/
http://bakas1e.xyz/5.jpg https://threatfox.abuse.ch/ioc/237969/
http://bakas1e.xyz/7.jpg https://threatfox.abuse.ch/ioc/237970/

Intelligence

File Origin
# of uploads :
1
# of downloads :
146
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/200405/
Detection(s):
SecuriteInfo.com.W32.MSIL_Kryptik.FYP.genEldorado.15544.32048.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file in the %temp% directory
Delayed writing of the file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
hacktool obfuscated packed
Link:
https://www.filescan.io/uploads/61790c2d9a5a1e91c5d6b7c9/reports/589c1f69-d854-42c0-a10a-d018c28e0766/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Oski Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/63c4c4a7-b68f-4f1f-bd4f-e9d746c811e4
Result
Threat name:
Oski Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/877587
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
Downloads files with wrong headers with respect to MIME Content-Type
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Posts data to a JPG file (protocol mismatch)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected AntiVM3
Yara detected Oski Stealer
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 510023 Sample: PO294232.exe Startdate: 27/10/2021 Architecture: WINDOWS Score: 100 37 Found malware configuration 2->37 39 Antivirus detection for URL or domain 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 8 other signatures 2->43 8 PO294232.exe 3 2->8         started        process3 file4 25 C:\Users\user\AppData\...\PO294232.exe.log, ASCII 8->25 dropped 45 Performs DNS queries to domains with low reputation 8->45 47 Injects a PE file into a foreign processes 8->47 12 PO294232.exe 196 8->12         started        17 PO294232.exe 8->17         started        signatures5 process6 dnsIp7 35 bakas1e.xyz 104.21.55.254, 49752, 80 CLOUDFLARENETUS United States 12->35 27 C:\ProgramData\vcruntime140.dll, PE32 12->27 dropped 29 C:\ProgramData\sqlite3.dll, PE32 12->29 dropped 31 C:\ProgramData\softokn3.dll, PE32 12->31 dropped 33 4 other files (none is malicious) 12->33 dropped 49 Tries to harvest and steal browser information (history, passwords, etc) 12->49 51 Tries to steal Crypto Currency Wallets 12->51 19 cmd.exe 1 12->19         started        file8 signatures9 process10 process11 21 taskkill.exe 1 19->21         started        23 conhost.exe 19->23         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/192f884438809d6fb01ae0c89c4ccd1fdae62d429e78bdbcc4ff4d28a54049af/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-10-27 08:22:07 UTC
AV detection:
8 of 44 (18.18%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dexyqrbyqcow7ma24dejytgnd7nomlkctz4l3pge75gsrjkajgxq._file
Verdict:
malicious
Similar samples:
024a5c3d369e1459332682cad7931a426722fdc2ec0950adc598e0227d0ef043
OskiStealer
4ee9983bc82214479876383c1caa6c1800df1d9d9bc733bf0be74150570b12d0
OskiStealer
652ff7f52f0e2d6bdd5a0f36f4b24c4dafc8aab7d5236db91b77267650cdb140
OskiStealer
a54ecc8d83199ee37e9af81592b4b3dbc037aaa14eba989f6dc0504a570bcc9c
OskiStealer
b43dde5ca3d23d16af5bf34c522869dff9624a78be67dfc3acde5c81ef24d318
OskiStealer
c17243e46ff224631e589c55642c3666e5c560715841e8b8ebdd511cb70da8dd
OskiStealer
d53af79b3996389ff73ab33578448fd5e6ee2698251451ed3df7c63ba025fd21
OskiStealer
dda5d47308c0ebcb2555cda19b4c05a88d633396909456b9ee5fcee42e197724
OskiStealer
+ 3'932 additional samples on MalwareBazaar
Result
Malware family:
oski
Create hunting rule
Score:
  10/10
Tags:
family:oski discovery infostealer spyware stealer
Link:
https://tria.ge/reports/211027-j9k1haahg6/
Behaviour
Checks processor information in registry
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Oski
Malware Config
C2 Extraction:
bakas1e.xyz
Unpacked files
SH256 hash:
6563528d10ffb3894a0dcb098df45c8e94989c7d4a99cfc145ab6670916d1f3d
MD5 hash:
c7fa0d0dc0386dcb55645bd58f002946
SHA1 hash:
76161b734366692c71a0ba1186ed73446b29357f
Link:
https://www.unpac.me/results/6d438f6a-d9a5-49a6-9b56-dc53a274d285/
SH256 hash:
314e4c7fdca5c300e8f67c41ca150052f35043df1a16184c5f72f1ed969892bf
MD5 hash:
6cd79027df0d78d116146599e3f9af66
SHA1 hash:
70db68ab028b7ac3381e6eba202d8fedfe989de6
Detections:
win_oski_g0
Create hunting rule
win_oski_auto
Create hunting rule
Link:
https://www.unpac.me/results/6d438f6a-d9a5-49a6-9b56-dc53a274d285/
SH256 hash:
4d1ee061c817ea30ca4e461a4f44388662c1c1c2775be2b323858ddbc1679b35
MD5 hash:
1b6d3d31872537cc611ff4322ffc1099
SHA1 hash:
0108adafb207ce044bfb3f7933da45594c545bee
Link:
https://www.unpac.me/results/6d438f6a-d9a5-49a6-9b56-dc53a274d285/
SH256 hash:
192f884438809d6fb01ae0c89c4ccd1fdae62d429e78bdbcc4ff4d28a54049af
MD5 hash:
2ed2d26ee75e5bc46a355c0265dd4719
SHA1 hash:
7d45cf3ded4de7432aaeaac18937e13e567d4e81
Link:
https://www.unpac.me/results/6d438f6a-d9a5-49a6-9b56-dc53a274d285/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/192f88443880/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/192f884438809d6fb01ae0c89c4ccd1fdae62d429e78bdbcc4ff4d28a54049af

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload
Rule name:win_oski_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.oski.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/200405/

Comments