Oski Stealer Malware Research Report

ZeroFOX Alpha Team has analyzed recent reporting on the Oski Stealer malware and released this advisory which serves as an overview of this malware and the potential threats it may pose. There was a recent tweet from a security researcher who linked to this admin panel being used by the Oski Stealer malware, which prompted our investigation. Oski Stealer malware appears to have been around since at least August of 2019, with screenshots of the first version being included in various news outlets. Around 2 months ago however, a new administration panel has been identified being circulated.

Details

This malware is designed to steal a variety of sensitive information, with some pre-defined data types, such as credentials, credit card numbers, crypto currency wallets. In addition, attackers who deploy this malware and use the Oski Stealer admin panel can configure the malware to steal any number of file types or site information using customizable rules in the admin panel. It uses a variety of methods to extract this data, most commonly through the Windows registry, from the SQLite databases that the browsers use, extracting session cookies or through browser hooks using DLL injection.

The new Oski Stealer admin panel we are seeing, features an enhanced dashboard which gives controllers a "single pane of glass" view of their victims, including total number of logs, number of passwords captured, top infected countries, top sites that users viewed, and top browsers used by victims. Controllers can then use the log viewer to view individual victim captures, including any crypto wallets captured or passwords for various sites being used or specify what sites to capture using "Marker Rules". This malware will also include the contents of the user's desktop or other file folders that the controller would specify in the "Grab Rules" section of the admin panel.

Figure #1 Login Panel for Oski Stealer

Due to the hardcoded domain included in the malware, we identified a related VirusTotal sample, which can be used for further context on this threat. Most notably, you can see the various files opened/written, files dropped, modified registry keys, and process/service actions happening on the infected Windows machine.

This malware has been relatively successful due to not needing admin rights to be installed, and being able to be ran on x86 and x64 versions of Windows 7, 8, 8.1, and 10. In the panel our team had access to, we identified numerous countries being targeted, with victims being heavily from the United States, and with credentials ranging from social networks to banking and gaming sites. There was only 1 victim out of the ~300+ victims we saw that had crypto related information being stolen, however, almost all of the victims we saw had username and passwords stolen.

Figure #2 Admin Panel for Oski Stealer

Conclusion

Due to the broad number of victim architectures targeted, the ease of use of the admin panel by attackers, and the type of data collected from victims, this malware could pose a relevant threat to customers of ZeroFOX. Attackers can quickly and easily identify stolen social media or email credentials which could allow for further pivoting into your company or to be used in other attacks.