MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a1643bbeb085792684f579b51b1da8d3adbd40e0e4815ab6d92d30d5c7e1f33. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


OskiStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a1643bbeb085792684f579b51b1da8d3adbd40e0e4815ab6d92d30d5c7e1f33
SHA3-384 hash: b5ae6460a87a41703ae751df0e2d28abc0c247d59d22d86ec91cfd5d6d2cc30ddab26112491710e48ec3ee286c18eecf
SHA1 hash: 2e5f012bff7da3a7da2216127fe45a09905e5966
MD5 hash: 64fafbc31b117e43f94b35b3fa39a096
humanhash: west-helium-seventeen-dakota
File name:64fafbc31b117e43f94b35b3fa39a096.exe
Download: download sample
Signature OskiStealer
Create hunting rule
File size:1'117'696 bytes
First seen:2021-12-16 08:38:58 UTC
Last seen:2021-12-16 11:18:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 24576:EserMkkvlq4l23QoHd4FSpAZvnnPEZYJq41vsXrLRxfgkOHZIGG:3Nq+23J4FSp0nn+cPvsX4RSGG
TLSH T12135235037F4DA12C35ECF3A26B380901175BA5BA929FB0B6CC4B18D342FB559582B9F
File icon (PE):PE icon
dhash icon b3b3333969693b3b (69 x Formbook, 63 x AgentTesla, 26 x Loki)
Reporter abuse_ch
Tags:exe OskiStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
143
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Vidar
Create hunting rule
Link:
https://www.capesandbox.com/analysis/214505/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1130.20453.28601.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Reading critical registry keys
Delayed writing of the file
Creating a process with a hidden window
Running batch commands
Stealing user critical data
Launching a tool to kill processes
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61bafb2f8541392eb4ea37ae/reports/97133ce0-fd36-4125-83cc-0f744cb8b812/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Oski Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c20bc43e-bd69-41f6-9e31-df585e75c8cb
Result
Threat name:
Oski Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/908349
Signature
.NET source code contains potential unpacker
Antivirus detection for dropped file
Antivirus detection for URL or domain
Changes security center settings (notifications, updates, antivirus, firewall)
Creates autostart registry keys with suspicious names
Creates files in alternative data streams (ADS)
Creates multiple autostart registry keys
Detected unpacking (overwrites its own PE header)
Downloads files with wrong headers with respect to MIME Content-Type
Drops PE files to the user root directory
Found many strings related to Crypto-Wallets (likely being stolen)
Found strings related to Crypto-Mining
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Posts data to a JPG file (protocol mismatch)
Sigma detected: Windows Crypto Mining Indicators
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected AntiVM3
Yara detected Oski Stealer
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 540836 Sample: sAHuzbfzyE.exe Startdate: 16/12/2021 Architecture: WINDOWS Score: 100 65 192.110.160.114, 443, 49841 IOFLOODUS United States 2->65 67 pool.supportxmr.com 2->67 69 2 other IPs or domains 2->69 97 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->97 99 Malicious sample detected (through community Yara rule) 2->99 101 Antivirus detection for URL or domain 2->101 103 14 other signatures 2->103 9 sAHuzbfzyE.exe 3 2->9         started        13 update_211610.exe 2->13         started        16 svchost.exe 2->16         started        18 9 other processes 2->18 signatures3 process4 dnsIp5 55 C:\Users\user\AppData\...\sAHuzbfzyE.exe.log, ASCII 9->55 dropped 109 Injects a PE file into a foreign processes 9->109 20 sAHuzbfzyE.exe 199 9->20         started        83 ip-api.com 13->83 111 Detected unpacking (overwrites its own PE header) 13->111 113 May check the online IP address of the machine 13->113 115 Changes security center settings (notifications, updates, antivirus, firewall) 16->115 85 127.0.0.1 unknown unknown 18->85 87 ip-api.com 18->87 file6 signatures7 process8 dnsIp9 71 marketcryptolab.com 88.214.194.166, 49766, 49786, 49800 NATCOWEBUS United Kingdom 20->71 73 golfhomexpresx.ir 172.67.173.158, 49763, 80 CLOUDFLARENETUS United States 20->73 75 192.168.2.1 unknown unknown 20->75 47 C:\Users\user\AppData\Local\...\last[1].exe, PE32 20->47 dropped 49 C:\ProgramData\011440066104.exe, PE32 20->49 dropped 51 C:\...\011440066104.exe:Zone.Identifier, ASCII 20->51 dropped 53 7 other files (none is malicious) 20->53 dropped 105 Creates files in alternative data streams (ADS) 20->105 107 Tries to steal Crypto Currency Wallets 20->107 25 011440066104.exe 15 22 20->25         started        30 cmd.exe 20->30         started        file10 signatures11 process12 dnsIp13 79 ip-api.com 208.95.112.1, 49768, 49771, 49775 TUT-ASUS United States 25->79 81 marketcryptolab.com 25->81 57 C:\Users\user\...\update_211610.exe (copy), PE32 25->57 dropped 59 C:\Users\user\AppData\...\tmpC447.tmp.exe, PE32 25->59 dropped 61 C:\Users\user\AppData\Local\Temp\Zip.exe, PE32 25->61 dropped 63 2 other files (none is malicious) 25->63 dropped 117 Antivirus detection for dropped file 25->117 119 Multi AV Scanner detection for dropped file 25->119 121 Detected unpacking (overwrites its own PE header) 25->121 123 5 other signatures 25->123 32 tmpC447.tmp.exe 25->32         started        36 Zip.exe 25->36         started        39 conhost.exe 30->39         started        41 taskkill.exe 30->41         started        file14 signatures15 process16 dnsIp17 43 C:\Users\user\AppData\Local\Temp\xmrig.exe, PE32+ 32->43 dropped 45 C:\Users\user\AppData\...\updater-win.exe, PE32 32->45 dropped 89 Machine Learning detection for dropped file 32->89 91 Creates autostart registry keys with suspicious names 32->91 93 Creates multiple autostart registry keys 32->93 77 ip-api.com 36->77 95 May check the online IP address of the machine 36->95 file18 signatures19
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3a1643bbeb085792684f579b51b1da8d3adbd40e0e4815ab6d92d30d5c7e1f33/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-12-16 03:37:31 UTC
File Type:
PE (.Net Exe)
Extracted files:
28
AV detection:
27 of 45 (60.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hileho7lbblze2cpk6nvdmo2ru5nxvaobzeblk3nsljq2xd6d4zq._file
Verdict:
malicious
Result
Malware family:
oski
Create hunting rule
Score:
  10/10
Tags:
family:oski collection discovery infostealer persistence spyware stealer suricata
Link:
https://tria.ge/reports/211216-kkbafaccgk/
Behaviour
Checks processor information in registry
Kills process with taskkill
NTFS ADS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Looks up external IP address via web service
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Oski
suricata: ET MALWARE Generic gate .php GET with minimal headers
Malware Config
C2 Extraction:
golfhomexpresx.ir
Unpacked files
SH256 hash:
58ffaa98ea23de16e10355dbf4d7bbce13b45b16102da499b003fd707b4eb5ba
MD5 hash:
5e0f5cdbc6104a979cc92ba293b3b1c9
SHA1 hash:
124a5d02b50da7caa078d4cae6d7ad455a7a2e26
Detections:
win_oski_g0
Create hunting rule
win_oski_auto
Create hunting rule
Link:
https://www.unpac.me/results/b07149aa-2bdc-42a1-8925-591d91ad9043/
Parent samples :
125b5a322966a51616fad074a1d5aa4dd1979ff453889d55b01aedd9fa54262e
931f271552b5170cbcee380f9fc5742d890e9063181645f010cf0b942ea2787a
fb142a5509971d78923e077c658479a60287c1e6d921adfc75f3a426b5ffab7b
f62eb2c218ce5b7958aa7fcd2aa5c604fcc571e10bb4c373bb396d9e85733e44
3a1643bbeb085792684f579b51b1da8d3adbd40e0e4815ab6d92d30d5c7e1f33
cabe623befbaa25599e9c97bef6be8175332b29c6571a2c8e755c7a732beedbd
SH256 hash:
e0084dc966cde73684bf17440a6f8585c399b12e204512e0674ee4e0c2994fd7
MD5 hash:
6b75c5d6dbe7e05cde9bf5de4a916bba
SHA1 hash:
0bfad56382c341b0a75214c94ff075c4e922dc85
Link:
https://www.unpac.me/results/b07149aa-2bdc-42a1-8925-591d91ad9043/
SH256 hash:
0ed5acff89f426f0da41c99ab656138e2c94e14dd49ae4fa14f003ce13274751
MD5 hash:
8a9081a6ead817d95ee71fabd08d4c07
SHA1 hash:
0a49050c9f4330f1af52641fe9716812a7830ede
Link:
https://www.unpac.me/results/b07149aa-2bdc-42a1-8925-591d91ad9043/
SH256 hash:
3a1643bbeb085792684f579b51b1da8d3adbd40e0e4815ab6d92d30d5c7e1f33
MD5 hash:
64fafbc31b117e43f94b35b3fa39a096
SHA1 hash:
2e5f012bff7da3a7da2216127fe45a09905e5966
Link:
https://www.unpac.me/results/b07149aa-2bdc-42a1-8925-591d91ad9043/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3a1643bbeb085792684f579b51b1da8d3adbd40e0e4815ab6d92d30d5c7e1f33

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload
Rule name:win_oski_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.oski.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

OskiStealer

Executable exe 3a1643bbeb085792684f579b51b1da8d3adbd40e0e4815ab6d92d30d5c7e1f33

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1862603/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/214505/

Comments