MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60d1297adb502d942493a794945336aea891d2c321476ef3349ac07726fca7c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


OskiStealer


Vendor detections: 13


Intelligence 13 IOCs 7 YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 60d1297adb502d942493a794945336aea891d2c321476ef3349ac07726fca7c3
SHA3-384 hash: 5357221d88a039aa0fc0333090bcb942156620e82207c48807d57c2dab34dfecaa2d88300bc52cdc298d5f6546589755
SHA1 hash: 790969675e8cec28cf19c18625dd764884459b01
MD5 hash: 7536b74c17754363799df14fe70d3a92
humanhash: spaghetti-tennessee-stairway-oregon
File name:7536b74c17754363799df14fe70d3a92.exe
Download: download sample
Signature OskiStealer
Create hunting rule
File size:1'018'880 bytes
First seen:2021-08-03 10:41:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:be4t9eZHlEWAxjvsMF3mKAk618T7xlkvvyrmT9EXvStCgEfW54n2iN1T:beVOsMdl6ixlYdT9So0e6n1H
Threatray 2'231 similar samples on MalwareBazaar
TLSH T14825491013D6C68CE3A6D7F10BC6E01F56A9EC339E14AEAC395DB271FAB1964481D372
dhash icon c4dab8f8e4e4e2dc (1 x OskiStealer, 1 x CoinMiner, 1 x RemcosRAT)
Reporter abuse_ch
Tags:exe OskiStealer


Avatar
abuse_ch
OskiStealer C2:
http://2.56.59.226/www//6.jpg

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://2.56.59.226/www//6.jpg https://threatfox.abuse.ch/ioc/165519/
http://2.56.59.226/www//1.jpg https://threatfox.abuse.ch/ioc/165520/
http://2.56.59.226/www//7.jpg https://threatfox.abuse.ch/ioc/165521/
http://2.56.59.226/www//2.jpg https://threatfox.abuse.ch/ioc/165522/
http://2.56.59.226/www//3.jpg https://threatfox.abuse.ch/ioc/165523/
http://2.56.59.226/www//4.jpg https://threatfox.abuse.ch/ioc/165524/
http://2.56.59.226/www//5.jpg https://threatfox.abuse.ch/ioc/165525/

Intelligence

File Origin
# of uploads :
1
# of downloads :
125
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
swift_message_723-18-22-78_2-8-2021.doc
Verdict:
Malicious activity
Analysis date:
2021-08-03 08:39:44 UTC
Tags:
ole-embedded loader trojan stealer vidar
Link:
https://app.any.run/tasks/cf8631ac-53d6-492b-ad40-3845fc26ccc5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Vidar
Create hunting rule
Link:
https://www.capesandbox.com/analysis/176010/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Connection attempt
Launching the default Windows debugger (dwwin.exe)
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Oski Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e4e540a8-8f78-4759-ab15-53b60da50aaf
Result
Threat name:
Oski Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/826072
Signature
Downloads files with wrong headers with respect to MIME Content-Type
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Posts data to a JPG file (protocol mismatch)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected AntiVM3
Yara detected Oski Stealer
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 458494 Sample: qeGh0s4lgw.exe Startdate: 03/08/2021 Architecture: WINDOWS Score: 100 34 Found malware configuration 2->34 36 Multi AV Scanner detection for submitted file 2->36 38 Yara detected Oski Stealer 2->38 40 7 other signatures 2->40 8 qeGh0s4lgw.exe 3 2->8         started        process3 file4 22 C:\Users\user\AppData\...\qeGh0s4lgw.exe.log, ASCII 8->22 dropped 11 qeGh0s4lgw.exe 193 8->11         started        process5 dnsIp6 32 2.56.59.226, 49729, 80 GBTCLOUDUS Netherlands 11->32 24 C:\ProgramData\vcruntime140.dll, PE32 11->24 dropped 26 C:\ProgramData\sqlite3.dll, PE32 11->26 dropped 28 C:\ProgramData\softokn3.dll, PE32 11->28 dropped 30 4 other files (none is malicious) 11->30 dropped 42 Tries to harvest and steal browser information (history, passwords, etc) 11->42 44 Tries to steal Crypto Currency Wallets 11->44 16 cmd.exe 1 11->16         started        file7 signatures8 process9 process10 18 taskkill.exe 1 16->18         started        20 conhost.exe 16->20         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/60d1297adb502d942493a794945336aea891d2c321476ef3349ac07726fca7c3/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-08-03 09:31:17 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mdiss6w3kawzijetu6kjiuzwv2ujduwdefdw54zutlahojx4u7bq._file
Verdict:
malicious
Similar samples:
8e07cf5e12ed70918b410fdb95fdf6905c191df169df5fdf994daac99c8bd359
OskiStealer
90a9ef1c549a9f2646f6c603e27570832f371d25d2fc4b967c96f55fa034e557
OskiStealer
a375d88a6666e7101b4f582ea0239033e4716e883ecb301245011e9c58054a9c
OskiStealer
c0765fd53d64c425a848b89fa1168552fd2cae90984cfa14c0b7d4e0789fece7
OskiStealer
d022b7b48419dbef83e9d084602cbb5b10566d193db01248a72be46251669a97
OskiStealer
e5cfbeb6e53527b724d1a710c44dd7f86a0befadb35db2c81ee1ec9aafd12b40
OskiStealer
f85de586c3a33df88ebb5493c0bbcbd18c9f732e201c4c1604f2b2779976434e
OskiStealer
+ 2'221 additional samples on MalwareBazaar
Result
Malware family:
oski
Create hunting rule
Score:
  10/10
Tags:
family:oski discovery infostealer spyware stealer suricata
Link:
https://tria.ge/reports/210803-2h19acr4tx/
Behaviour
Checks processor information in registry
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Oski
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
Malware Config
C2 Extraction:
http://2.56.59.226/www/
Unpacked files
SH256 hash:
cfef97ff706312dff4edd998aeee22f1283221631ebb0cc954bebbb701c1465c
MD5 hash:
a0f625a3d3348903f3c902f588c0e4f5
SHA1 hash:
20d1f0b74abe6f500e8c21119f55281926210ac0
Link:
https://www.unpac.me/results/dc2489fa-27d8-425d-90ef-67e577afb472/
SH256 hash:
95d1e775738c7ce2ce37de6ddf9f7288e9b672180540773329c9319664d669b2
MD5 hash:
621a977e74a69cbd16d97f03d51e11f1
SHA1 hash:
42baa6b7d94c7f2be7622624536e91e2c1b35428
Detections:
win_oski_g0
Create hunting rule
win_oski_auto
Create hunting rule
Link:
https://www.unpac.me/results/dc2489fa-27d8-425d-90ef-67e577afb472/
SH256 hash:
0121b16ec9e6f1237aef8b85b81d2e5c310c67524e297ef6a67e8af488aaac56
MD5 hash:
d2bc64d539c7e0209886c9ddc4d5868b
SHA1 hash:
f6dc12f01d0139fca6a4fc661d7e5fbc1aeb44a5
Link:
https://www.unpac.me/results/dc2489fa-27d8-425d-90ef-67e577afb472/
SH256 hash:
60d1297adb502d942493a794945336aea891d2c321476ef3349ac07726fca7c3
MD5 hash:
7536b74c17754363799df14fe70d3a92
SHA1 hash:
790969675e8cec28cf19c18625dd764884459b01
Link:
https://www.unpac.me/results/dc2489fa-27d8-425d-90ef-67e577afb472/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/60d1297adb50/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/60d1297adb502d942493a794945336aea891d2c321476ef3349ac07726fca7c3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload
Rule name:win_oski_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.oski.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

OskiStealer

Executable exe 60d1297adb502d942493a794945336aea891d2c321476ef3349ac07726fca7c3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1501955/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/176010/

Comments