MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52338add561f1e396b0f8377e77bae2a05bcb8d7cc19548dbf9ff8cf0b57cc1f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


OskiStealer


Vendor detections: 14


Intelligence 14 IOCs 7 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 52338add561f1e396b0f8377e77bae2a05bcb8d7cc19548dbf9ff8cf0b57cc1f
SHA3-384 hash: ddd1da1c1608c1966915cc4f1fc5f312976cfa8c18d32df543178102e1fca9cac1650d3d7aba5fb7fcc1bcf55dbfadae
SHA1 hash: 79b6a5708b05b88847b605dfe5271073826ba5f4
MD5 hash: 3ac80dee855e85c52c0170373af79a04
humanhash: hamper-mexico-ten-neptune
File name:52338ADD561F1E396B0F8377E77BAE2A05BCB8D7CC195.exe
Download: download sample
Signature OskiStealer
Create hunting rule
File size:204'800 bytes
First seen:2022-04-20 16:41:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7bb9d345a5fec4fbbf5100d6a3ffbb8c (88 x ArkeiStealer, 85 x OskiStealer, 1 x Reconyc)
ssdeep 3072:WfUomEuYm98dlSq7gt5q7Dx+XgS6aCEwhOfUbCalNT2pbB3fIC1Xi6FLPo3c:WfUauY68uSWCx+XA7mg2pNr1Ljo3c
Threatray 730 similar samples on MalwareBazaar
TLSH T18D146D30B690C035E8A310BCDDEE86BEB96C7A301F5950C3A3D45A662F712F27A71657
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe OskiStealer


Avatar
abuse_ch
OskiStealer C2:
http://62.77.159.212/6.jpg

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://62.77.159.212/6.jpg https://threatfox.abuse.ch/ioc/522030/
http://62.77.159.212/1.jpg https://threatfox.abuse.ch/ioc/522031/
http://62.77.159.212/2.jpg https://threatfox.abuse.ch/ioc/522032/
http://62.77.159.212/3.jpg https://threatfox.abuse.ch/ioc/522033/
http://62.77.159.212/4.jpg https://threatfox.abuse.ch/ioc/522034/
http://62.77.159.212/5.jpg https://threatfox.abuse.ch/ioc/522035/
http://62.77.159.212/7.jpg https://threatfox.abuse.ch/ioc/522036/

Intelligence

File Origin
# of uploads :
1
# of downloads :
272
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
vidar
Create hunting rule
ID:
1
File name:
https://www33.zippyshare.com/d/hvc6SWB0/405227/Oski_Stealer.rar
Verdict:
Malicious activity
Analysis date:
2020-12-08 22:24:35 UTC
Tags:
trojan stealer vidar loader
Link:
https://app.any.run/tasks/0a9f39aa-4344-4831-a050-516a53895606

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Vidar
Create hunting rule
Link:
https://www.capesandbox.com/analysis/265196/
Detection(s):
Win.Malware.Zusy-9781646-0
Create hunting rule

ditekSHen.MALWARE.Win.Trojan.Vidar.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware vidar virus zusy
Link:
https://www.filescan.io/uploads/626037daffe27d51191983c0/reports/8ff626e2-8b23-41c1-be51-f9e3e3c4089c/overview
Malware family:
Oski Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b4402b87-cd17-403a-bb63-dcc616c5a955
Result
Threat name:
Oski Stealer Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/979812
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/52338add561f1e396b0f8377e77bae2a05bcb8d7cc19548dbf9ff8cf0b57cc1f/
Threat name:
Win32.Infostealer.Vidar
Create hunting rule
Status:
Malicious
First seen:
2020-12-09 05:50:42 UTC
File Type:
PE (Exe)
AV detection:
27 of 34 (79.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kizyvxkwd4pds2ypqn36o65ofic3zogxzqmvjdn7t74m6c2xzqpq._file
Verdict:
malicious
Similar samples:
6849e65e9ac20880fa99583b202ae710e0a3885cd72692a0c1b4d72aae109adf
OskiStealer
8399c97b606bb6613f99006964a47064e402e6489574b85db7a9872f601886b2
OskiStealer
913a7c8a88dc0720ff7fe2005243939f2fdadc129f69a46cc8fcfe54a16f0e75
OskiStealer
a414ef0d5392718a4307dbb6a5d38ca3285d9aa002d93ee1ea5d45320d082769
OskiStealer
b61bba8ff91848c1f2b60dd8c98de6979f14c3366826e4d5c18c130758d5f050
OskiStealer
d8454e6022d16c264f078c2a0b925dc70d08edd251dc6e86f1af4b24afd46bde
OskiStealer
+ 720 additional samples on MalwareBazaar
Result
Malware family:
oski
Create hunting rule
Score:
  10/10
Tags:
family:oski infostealer spyware stealer
Link:
https://tria.ge/reports/220420-t7m27aaac4/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Reads user/profile data of web browsers
Oski
Malware Config
C2 Extraction:
62.77.159.212
Unpacked files
SH256 hash:
52338add561f1e396b0f8377e77bae2a05bcb8d7cc19548dbf9ff8cf0b57cc1f
MD5 hash:
3ac80dee855e85c52c0170373af79a04
SHA1 hash:
79b6a5708b05b88847b605dfe5271073826ba5f4
Detections:
win_oski_g0
Create hunting rule
win_oski_auto
Create hunting rule
Link:
https://www.unpac.me/results/b923dd6c-f088-4988-bf3c-7c4e9351856c/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/52338add561f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/52338add561f1e396b0f8377e77bae2a05bcb8d7cc19548dbf9ff8cf0b57cc1f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload
Rule name:win_oski_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.oski.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/265196/

Comments