MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 523467ea00cd16838f931a9516fa3fbbad9aa9e84f30b1d40ba028390c4bb8f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


OskiStealer


Vendor detections: 10


Maldoc score: 11


Intelligence 10 IOCs 7 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 523467ea00cd16838f931a9516fa3fbbad9aa9e84f30b1d40ba028390c4bb8f2
SHA3-384 hash: 7cc1c489cf0b046c31a5b5742dbff733854d9b38b5518bed9e23de1a1b39aae80f83a7dfddb1d3291e1f85200fea3ea1
SHA1 hash: 81d0d35195d2b901d32dbae3919453a9e236052d
MD5 hash: 4483a62c42f0566f53d6a8f99177430a
humanhash: princess-xray-juliet-quiet
File name:IMG0540001825.doc
Download: download sample
Signature OskiStealer
Create hunting rule
File size:150'528 bytes
First seen:2021-04-29 20:15:52 UTC
Last seen:2021-04-29 21:09:05 UTC
File type:Word file doc
MIME type:application/msword
ssdeep 1536:emMXH4g4gpA2M7KPDqq0qHXG0uODuKtQJSNT+VBWOo/BmO9x8P8vkwj5oLfpf2QO:UX4GpNXrq6uObF6VBWOckkvkwj0fpbp
TLSH 5EE302863BD4CD2AD0A6A5704CDBC085BB99BC5EAC59839B7B447B0E7DF53704A23348
Reporter abuse_ch
Tags:doc OskiStealer


Avatar
abuse_ch
OskiStealer C2:
http://5azc.club/1.jpg

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://5azc.club/6.jpg https://threatfox.abuse.ch/ioc/25075/
http://5azc.club/1.jpg https://threatfox.abuse.ch/ioc/25076/
http://5azc.club/2.jpg https://threatfox.abuse.ch/ioc/25077/
http://5azc.club/3.jpg https://threatfox.abuse.ch/ioc/25078/
http://5azc.club/4.jpg https://threatfox.abuse.ch/ioc/25079/
http://5azc.club/5.jpg https://threatfox.abuse.ch/ioc/25080/
http://5azc.club/7.jpg https://threatfox.abuse.ch/ioc/25081/

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 11
Application name is Microsoft Office Word
Office document is in OLE format
Office document contains VBA Macros
OLE dump

MalwareBazaar was able to identify 12 sections in this file using oledump:

Section IDSection sizeSection name
1114 bytesCompObj
24096 bytesDocumentSummaryInformation
34096 bytesSummaryInformation
46979 bytes1Table
5119138 bytesData
6406 bytesMacros/PROJECT
765 bytesMacros/PROJECTwm
8960 bytesMacros/VBA/Module1
91956 bytesMacros/VBA/ThisDocument
102624 bytesMacros/VBA/_VBA_PROJECT
11561 bytesMacros/VBA/dir
124096 bytesWordDocument
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecDocument_OpenRuns when the Word or Publisher document is opened
SuspiciousCreateObjectMay create an OLE object
SuspiciousChrMay attempt to obfuscate specific strings (use option --deobf to deobfuscate)
SuspiciousexecMay run an executable file or a system
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
SuspiciousBase64 StringsBase64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
3
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
File type:
application/msword
Has a screenshot:
False
Contains macros:
True
Detection(s):
TwinWave.EvilDoc.DOCXSTRGOOD..EXE.200225.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.CROStringGamesBangBang.20200908.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.CROIndirectionGamesLeave.20210428.UNOFFICIAL
Create hunting rule

Sanesecurity.Badmacro.Doc.blankopen.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Searching for the window
Creating a file
Delayed writing of the file
Creating a file in the %temp% subdirectories
Creating a file in the Windows subdirectories
Modifying a system file
Creating a window
Launching a process by exploiting the app vulnerability
Result
Verdict:
Malicious
File Type:
Legacy Word File with Macro
Link:
https://app.docguard.net/523467ea00cd16838f931a9516fa3fbbad9aa9e84f30b1d40ba028390c4bb8f2/results/dashboard
Payload URLs
URL
File name
Project.Module1.produceblood
1Table
Document image
Image:
Download PNG
Document image
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/523467ea00cd16838f931a9516fa3fbbad9aa9e84f30b1d40ba028390c4bb8f2
Details
Macro with Startup Hook
Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.
Document With Few Pages
Document contains between one and three pages of content. Most malicious documents are sparse in page count.
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
expl.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/703096
Signature
Creates an undocumented autostart registry key
Document contains an embedded VBA macro which may execute processes
Document contains an embedded VBA macro with suspicious strings
Downloads files with wrong headers with respect to MIME Content-Type
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Posts data to a JPG file (protocol mismatch)
Powershell drops PE file
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 400473 Sample: IMG0540001825.doc Startdate: 29/04/2021 Architecture: WINDOWS Score: 100 63 Found malware configuration 2->63 65 Multi AV Scanner detection for dropped file 2->65 67 Multi AV Scanner detection for submitted file 2->67 69 11 other signatures 2->69 10 OUTLOOK.EXE 501 27 2->10         started        13 WINWORD.EXE 37 37 2->13         started        process3 file4 79 Suspicious powershell command line found 10->79 16 powershell.exe 15 18 10->16         started        47 C:\Users\user\...\IMG0540001825.doc.LNK, MS 13->47 dropped signatures5 process6 dnsIp7 57 scaladevelopments.scaladevco.com 35.208.24.64, 49735, 80 GOOGLE-2US United States 16->57 41 C:\Users\Public\...\educationleader.exe, PE32 16->41 dropped 71 Powershell drops PE file 16->71 21 educationleader.exe 6 16->21         started        26 conhost.exe 16->26         started        file8 signatures9 process10 dnsIp11 59 192.168.2.1 unknown unknown 21->59 43 C:\Users\user\AppData\Roaming\...\notpad.exe, PE32 21->43 dropped 45 C:\Users\user\AppData\...\educationleader.exe, PE32 21->45 dropped 73 Multi AV Scanner detection for dropped file 21->73 75 Creates an undocumented autostart registry key 21->75 77 Machine Learning detection for dropped file 21->77 28 educationleader.exe 193 21->28         started        33 educationleader.exe 21->33         started        file12 signatures13 process14 dnsIp15 61 5azc.club 95.181.164.213, 49742, 80 RACKTECHRU Russian Federation 28->61 49 C:\ProgramData\vcruntime140.dll, PE32 28->49 dropped 51 C:\ProgramData\sqlite3.dll, PE32 28->51 dropped 53 C:\ProgramData\softokn3.dll, PE32 28->53 dropped 55 4 other files (none is malicious) 28->55 dropped 81 Tries to harvest and steal browser information (history, passwords, etc) 28->81 83 Tries to steal Crypto Currency Wallets 28->83 35 cmd.exe 1 28->35         started        85 Multi AV Scanner detection for dropped file 33->85 87 Machine Learning detection for dropped file 33->87 file16 signatures17 process18 process19 37 conhost.exe 35->37         started        39 taskkill.exe 35->39         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/523467ea00cd16838f931a9516fa3fbbad9aa9e84f30b1d40ba028390c4bb8f2/
Threat name:
Document-Office.Trojan.Valyria
Create hunting rule
Status:
Malicious
First seen:
2021-04-29 20:16:14 UTC
AV detection:
16 of 47 (34.04%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ki2gp2qazulihd4tdkkrn6r7xowzvkpij4yldvaluaudsdclxdza._file
Result
Malware family:
oski
Create hunting rule
Score:
  10/10
Tags:
family:oski discovery infostealer macro macro_on_action spyware stealer xlm
Link:
https://tria.ge/reports/210429-sdvfyyhppe/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Kills process with taskkill
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Office loads VBA resources, possible macro or embedded object present
Enumerates physical storage devices
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Oski
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/523467ea00cd16838f931a9516fa3fbbad9aa9e84f30b1d40ba028390c4bb8f2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments