MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f62eb2c218ce5b7958aa7fcd2aa5c604fcc571e10bb4c373bb396d9e85733e44. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


OskiStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f62eb2c218ce5b7958aa7fcd2aa5c604fcc571e10bb4c373bb396d9e85733e44
SHA3-384 hash: 784cedf9b2ca6c51c873f671ffa8d4d55b0e5187561ac183f44f3b3760a33499cb33f664f7692f39031e1096e4277524
SHA1 hash: 0cb73eb3f3d6d5a8234d9fdb1e1bb80323cd55e1
MD5 hash: d42ca5b42777b9f0de6c690fce704025
humanhash: helium-august-oranges-yellow
File name:d42ca5b42777b9f0de6c690fce704025.exe
Download: download sample
Signature OskiStealer
Create hunting rule
File size:1'043'456 bytes
First seen:2021-12-16 08:38:34 UTC
Last seen:2021-12-16 11:18:21 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 24576:dg9Mo6a3xSMmEOy9v2y6pTuWOgBIe1moKcsRdDb:GkGOQv27fOgBRfxsRdDb
Threatray 3'319 similar samples on MalwareBazaar
TLSH T12925239267F9CA55E0DC4776193B890173357A361237E31E6AC5F0DE8E233130AA5B2B
Reporter abuse_ch
Tags:exe OskiStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
132
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Vidar
Create hunting rule
Link:
https://www.capesandbox.com/analysis/214503/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen3.8511.16931.15760.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Reading critical registry keys
Delayed writing of the file
Changing the Zone.Identifier stream
Creating a process from a recently created file
Creating a process with a hidden window
Running batch commands
Stealing user critical data
Query of malicious DNS domain
Launching a tool to kill processes
Sending an HTTP GET request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61bafb2c6daa353fa3b4d14b/reports/c734e7b4-589b-44ab-a014-d5d2676f346e/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Oski Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/48f65863-45f0-4f33-8392-902c3ee48464
Result
Threat name:
Oski Vidar Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/908353
Signature
.NET source code contains potential unpacker
Antivirus detection for dropped file
Antivirus detection for URL or domain
Creates autostart registry keys with suspicious names
Creates files in alternative data streams (ADS)
Creates multiple autostart registry keys
Detected unpacking (overwrites its own PE header)
Downloads files with wrong headers with respect to MIME Content-Type
Drops PE files to the user root directory
Found many strings related to Crypto-Wallets (likely being stolen)
Found strings related to Crypto-Mining
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Posts data to a JPG file (protocol mismatch)
Sigma detected: Windows Crypto Mining Indicators
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected AntiVM3
Yara detected Oski Stealer
Yara detected Vidar stealer
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 540827 Sample: Hj67HZkZkG.exe Startdate: 16/12/2021 Architecture: WINDOWS Score: 100 65 107.178.104.10, 443, 49785 IOFLOODUS United States 2->65 67 pool.supportxmr.com 2->67 69 pool-nyc.supportxmr.com 2->69 95 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->95 97 Malicious sample detected (through community Yara rule) 2->97 99 Antivirus detection for URL or domain 2->99 101 14 other signatures 2->101 9 Hj67HZkZkG.exe 3 2->9         started        13 update_211609.exe 14 3 2->13         started        16 update_211609.exe 2->16         started        18 3 other processes 2->18 signatures3 process4 dnsIp5 55 C:\Users\user\AppData\...\Hj67HZkZkG.exe.log, ASCII 9->55 dropped 107 Injects a PE file into a foreign processes 9->107 20 Hj67HZkZkG.exe 199 9->20         started        81 192.168.2.1 unknown unknown 13->81 83 ip-api.com 13->83 109 Detected unpacking (overwrites its own PE header) 13->109 111 May check the online IP address of the machine 13->111 85 ip-api.com 16->85 file6 signatures7 process8 dnsIp9 71 marketcryptolab.com 88.214.194.166, 49742, 49751, 49776 NATCOWEBUS United Kingdom 20->71 73 golfhomexpresx.ir 104.21.96.64, 49741, 80 CLOUDFLARENETUS United States 20->73 47 C:\Users\user\AppData\Local\...\last[1].exe, PE32 20->47 dropped 49 C:\ProgramData\567009505265.exe, PE32 20->49 dropped 51 C:\...\567009505265.exe:Zone.Identifier, ASCII 20->51 dropped 53 7 other files (none is malicious) 20->53 dropped 103 Creates files in alternative data streams (ADS) 20->103 105 Tries to steal Crypto Currency Wallets 20->105 25 567009505265.exe 15 22 20->25         started        30 cmd.exe 1 20->30         started        file10 signatures11 process12 dnsIp13 77 ip-api.com 208.95.112.1, 49745, 49746, 49747 TUT-ASUS United States 25->77 79 marketcryptolab.com 25->79 57 C:\Users\user\...\update_211609.exe. (copy), PE32 25->57 dropped 59 C:\Users\user\AppData\...\tmp5246.tmp.exe, PE32 25->59 dropped 61 C:\Users\user\AppData\Local\Temp\Zip.exe, PE32 25->61 dropped 63 2 other files (none is malicious) 25->63 dropped 113 Antivirus detection for dropped file 25->113 115 Multi AV Scanner detection for dropped file 25->115 117 Detected unpacking (overwrites its own PE header) 25->117 119 5 other signatures 25->119 32 tmp5246.tmp.exe 25->32         started        36 Zip.exe 25->36         started        39 taskkill.exe 1 30->39         started        41 conhost.exe 30->41         started        file14 signatures15 process16 dnsIp17 43 C:\Users\user\AppData\Local\Temp\xmrig.exe, PE32+ 32->43 dropped 45 C:\Users\user\AppData\...\updater-win.exe, PE32 32->45 dropped 87 Machine Learning detection for dropped file 32->87 89 Creates autostart registry keys with suspicious names 32->89 91 Creates multiple autostart registry keys 32->91 75 ip-api.com 36->75 93 May check the online IP address of the machine 36->93 file18 signatures19
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f62eb2c218ce5b7958aa7fcd2aa5c604fcc571e10bb4c373bb396d9e85733e44/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-12-15 16:27:27 UTC
File Type:
PE (.Net Exe)
Extracted files:
26
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6yxlfqqyzznxswfkp7gsvjogat6mk4pbbo2mg453hfwz5blthzca._file
Verdict:
malicious
Similar samples:
192f884438809d6fb01ae0c89c4ccd1fdae62d429e78bdbcc4ff4d28a54049af
OskiStealer
66a1b49f893976a60ca25813345ea54a5582acf7a5a0821c03cc45bcfc89b5c5
OskiStealer
6b869d8825516d0b977d48043d1d56d233de7b128074b068566dc33e0ff9fdb7
OskiStealer
b70f4075c4ce52960faacb101aac17a9cd734cbec86b6a9d63944e900420bde1
OskiStealer
e447edf7c703f03c3644f4d8b896974b7bfa59e7bc4036af5a800c7135dd09b0
OskiStealer
fb142a5509971d78923e077c658479a60287c1e6d921adfc75f3a426b5ffab7b
OskiStealer
+ 3'309 additional samples on MalwareBazaar
Result
Malware family:
oski
Create hunting rule
Score:
  10/10
Tags:
family:oski collection discovery infostealer persistence spyware stealer suricata
Link:
https://tria.ge/reports/211216-kkbafaccgj/
Behaviour
Checks processor information in registry
Kills process with taskkill
NTFS ADS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Looks up external IP address via web service
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Oski
suricata: ET MALWARE Generic gate .php GET with minimal headers
Malware Config
C2 Extraction:
golfhomexpresx.ir
Unpacked files
SH256 hash:
1cc6931523116a84d1e679f738d2931d72d7c9b9fdd405b8181a8b66437aea00
MD5 hash:
d45ac168751c0ed9be56af223eb9a761
SHA1 hash:
7c4304cf7b05acb4306171525ddcbd0850e39551
Link:
https://www.unpac.me/results/3460eade-5611-4683-892c-1772d13eed59/
SH256 hash:
18290f0691549e5bc3e5c6879c5813ecce52fd4beba2989c64850fd813ab4a3c
MD5 hash:
edf5a1aae353e5c13cd98211154c824f
SHA1 hash:
6a1b6be8b8d71540107d79cf05c455d2e713daa4
Link:
https://www.unpac.me/results/3460eade-5611-4683-892c-1772d13eed59/
SH256 hash:
58ffaa98ea23de16e10355dbf4d7bbce13b45b16102da499b003fd707b4eb5ba
MD5 hash:
5e0f5cdbc6104a979cc92ba293b3b1c9
SHA1 hash:
124a5d02b50da7caa078d4cae6d7ad455a7a2e26
Detections:
win_oski_g0
Create hunting rule
win_oski_auto
Create hunting rule
Link:
https://www.unpac.me/results/3460eade-5611-4683-892c-1772d13eed59/
Parent samples :
125b5a322966a51616fad074a1d5aa4dd1979ff453889d55b01aedd9fa54262e
931f271552b5170cbcee380f9fc5742d890e9063181645f010cf0b942ea2787a
fb142a5509971d78923e077c658479a60287c1e6d921adfc75f3a426b5ffab7b
f62eb2c218ce5b7958aa7fcd2aa5c604fcc571e10bb4c373bb396d9e85733e44
3a1643bbeb085792684f579b51b1da8d3adbd40e0e4815ab6d92d30d5c7e1f33
cabe623befbaa25599e9c97bef6be8175332b29c6571a2c8e755c7a732beedbd
SH256 hash:
f62eb2c218ce5b7958aa7fcd2aa5c604fcc571e10bb4c373bb396d9e85733e44
MD5 hash:
d42ca5b42777b9f0de6c690fce704025
SHA1 hash:
0cb73eb3f3d6d5a8234d9fdb1e1bb80323cd55e1
Link:
https://www.unpac.me/results/3460eade-5611-4683-892c-1772d13eed59/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f62eb2c218ce5b7958aa7fcd2aa5c604fcc571e10bb4c373bb396d9e85733e44

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

OskiStealer

Executable exe f62eb2c218ce5b7958aa7fcd2aa5c604fcc571e10bb4c373bb396d9e85733e44

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1862603/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/214503/

Comments