MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a375d88a6666e7101b4f582ea0239033e4716e883ecb301245011e9c58054a9c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


OskiStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a375d88a6666e7101b4f582ea0239033e4716e883ecb301245011e9c58054a9c
SHA3-384 hash: dd89aec7b258d34ec7935b92d20fec2365caf212b30e636b9e5b491dc04eff29af29c783261275bfced4d0a81fa3ac61
SHA1 hash: 1067652f21fd05902288613746b5e2ea79bd07f9
MD5 hash: ddde6fc0ce346b0ab7bb0c8c02a09d33
humanhash: kitten-alanine-one-fourteen
File name:ddde6fc0ce346b0ab7bb0c8c02a09d33
Download: download sample
Signature OskiStealer
Create hunting rule
File size:1'310'208 bytes
First seen:2021-07-28 13:01:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:PYhxa6BTGO/NkJWZeZQCmdjVv6LZRsXdmSLem2Vg4miT9UJESs6IcWByCcRQUBqh:PYv5CmHAIOsBgo0q4wMPnpx2XP4iO1H
TLSH T154556B757BFD3E0BF0BA477A507481B15570BE66EA02D33D781272CA0A33259C26972B
dhash icon 10d0c4c8ccccd010 (8 x AgentTesla, 1 x OskiStealer, 1 x AveMariaRAT)
Reporter zbetcheckin
Tags:32 exe OskiStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
GHAI SHIPMENT SCHEDULE 28TH-07-2021.exe
Verdict:
Malicious activity
Analysis date:
2021-07-28 08:06:43 UTC
Tags:
loader
Link:
https://app.any.run/tasks/1d6e09c9-2203-4ccd-95d4-6544ce97cf99

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/174646/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.953-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Oski Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/86534b9f-66e4-4021-9f6e-55db7a3da5ab
Result
Threat name:
Oski Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/823066
Signature
Adds a directory exclusion to Windows Defender
Downloads files with wrong headers with respect to MIME Content-Type
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Posts data to a JPG file (protocol mismatch)
Sigma detected: Powershell Defender Exclusion
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Oski Stealer
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 455478 Sample: Z8EtW5tW5J Startdate: 28/07/2021 Architecture: WINDOWS Score: 100 53 Found malware configuration 2->53 55 Multi AV Scanner detection for dropped file 2->55 57 Multi AV Scanner detection for submitted file 2->57 59 6 other signatures 2->59 8 Z8EtW5tW5J.exe 7 2->8         started        process3 file4 37 C:\Users\user\AppData\...\nllJKmehpTGztY.exe, PE32 8->37 dropped 39 C:\Users\user\AppData\Local\...\tmpBDF5.tmp, XML 8->39 dropped 41 C:\Users\user\AppData\...\Z8EtW5tW5J.exe.log, ASCII 8->41 dropped 61 Uses schtasks.exe or at.exe to add and modify task schedules 8->61 63 Adds a directory exclusion to Windows Defender 8->63 65 Injects a PE file into a foreign processes 8->65 12 Z8EtW5tW5J.exe 8->12         started        17 powershell.exe 20 8->17         started        19 powershell.exe 25 8->19         started        21 2 other processes 8->21 signatures5 process6 dnsIp7 51 fine.le-pearl.com 108.167.158.96, 49736, 80 UNIFIEDLAYER-AS-1US United States 12->51 43 C:\ProgramData\vcruntime140.dll, PE32 12->43 dropped 45 C:\ProgramData\sqlite3.dll, PE32 12->45 dropped 47 C:\ProgramData\softokn3.dll, PE32 12->47 dropped 49 4 other files (none is malicious) 12->49 dropped 67 Tries to harvest and steal browser information (history, passwords, etc) 12->67 69 Tries to steal Crypto Currency Wallets 12->69 23 cmd.exe 12->23         started        25 conhost.exe 17->25         started        27 conhost.exe 19->27         started        29 conhost.exe 21->29         started        31 conhost.exe 21->31         started        file8 signatures9 process10 process11 33 conhost.exe 23->33         started        35 taskkill.exe 23->35         started       
Gathering data
Threat name:
ByteCode-MSIL.Infostealer.Snakkel
Create hunting rule
Status:
Malicious
First seen:
2021-07-28 12:49:35 UTC
File Type:
PE (.Net Exe)
Extracted files:
48
AV detection:
12 of 28 (42.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=un25rctgm3trag2plaxkai4qgpshc3uih3ftaesfaepjywafjkoa._file
Verdict:
malicious
Result
Malware family:
oski
Create hunting rule
Score:
  10/10
Tags:
family:oski discovery infostealer spyware stealer suricata
Link:
https://tria.ge/reports/210728-gay7k3vz56/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
CustAttr .NET packer
Oski
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
Malware Config
C2 Extraction:
fine.le-pearl.com
Unpacked files
SH256 hash:
664a2086112cfe9d1c5a9a47731329c4f5d133a20b9a58cf5fd6baf2358bf248
MD5 hash:
ab5450282e13ef8adb0629403b4f47c3
SHA1 hash:
d848b4f81c01692ef3cf48666cc6b37895b9cd11
Detections:
win_oski_g0
Create hunting rule
win_oski_auto
Create hunting rule
Link:
https://www.unpac.me/results/0c3465b7-a48e-49d5-bba9-1ca60dac0a38/
Parent samples :
a375d88a6666e7101b4f582ea0239033e4716e883ecb301245011e9c58054a9c
c0765fd53d64c425a848b89fa1168552fd2cae90984cfa14c0b7d4e0789fece7
bbe006688e5f74473a5e248bc83651cbb7e9efbe8410abb8d8b84b4a59ed7750
SH256 hash:
e337a76dfdd30da005e03c428c527689115f559136380ea9e435af1f14cd2968
MD5 hash:
9d37e10b340568c73515b5ea110af95f
SHA1 hash:
b550947a691b8337161e57cb4cdaa25147f88c4d
Link:
https://www.unpac.me/results/0c3465b7-a48e-49d5-bba9-1ca60dac0a38/
SH256 hash:
fec35d5bc16b0d0a3c717e3682c350a1f3fc4c7184943824b5151c8972c7a80c
MD5 hash:
ae99189c2f6e9a2fadea7bbc8fbbd948
SHA1 hash:
9e20bef80267ae84f84d68a85cd29e0de0e8c4e5
Link:
https://www.unpac.me/results/0c3465b7-a48e-49d5-bba9-1ca60dac0a38/
SH256 hash:
97d2fa1d01b2f9a2199896e05e0cf60c14a9f41ef2d72e15fbb862b7afa08438
MD5 hash:
68463851c0e6fe7a254c99fae763d454
SHA1 hash:
4587a5371d88c296a0184fe47ee0c5245b187127
Link:
https://www.unpac.me/results/0c3465b7-a48e-49d5-bba9-1ca60dac0a38/
SH256 hash:
a375d88a6666e7101b4f582ea0239033e4716e883ecb301245011e9c58054a9c
MD5 hash:
ddde6fc0ce346b0ab7bb0c8c02a09d33
SHA1 hash:
1067652f21fd05902288613746b5e2ea79bd07f9
Link:
https://www.unpac.me/results/0c3465b7-a48e-49d5-bba9-1ca60dac0a38/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a375d88a6666e7101b4f582ea0239033e4716e883ecb301245011e9c58054a9c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

OskiStealer

Executable exe a375d88a6666e7101b4f582ea0239033e4716e883ecb301245011e9c58054a9c

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1487362/
Cape
Cape
https://www.capesandbox.com/analysis/174646/

Comments


Avatar
zbet commented on 2021-07-28 13:01:04 UTC

url : hxxp://swsaseguranca.com.br/xpm/apwxc.exe