Osno

Osno registers the rootkit DLL to AppInit_DLLs and enables LoadAppInit_DLLs so it is loaded with every process. Because the rookit DLLs are not signed, it sets RequireSignedAppInit_DLLs to 0.

Additional user for RDP access, password "5Z6aW8qRhLWEwS" Defaultuzer

Update.exe creates Run entry for persistence in the “HKCU\Software\Microsoft\Windows\CurrentVersion\Run” registry location and points to the file in “%AppData%\Roaming\scvhost\scvhostservice.exe“.

Just like that version, Osno will force Discord to load JScript files inject.js and discordmod.js ... Discord will then act as a stealer.

the RunPE method and VM/Debugger/Sandbox detection code are taken from CSharp-RunPE

Update.exe creates Run entry for persistence in the “HKCU\Software\Microsoft\Windows\CurrentVersion\Run” registry location and points to the file in “%AppData%\Roaming\scvhost\scvhostservice.exe“.

Osno registers the rootkit DLL to AppInit_DLLs and enables LoadAppInit_DLLs so it is loaded with every process... The rootkit uses MinHook to redirect WinAPI calls, so that it hides processes and file names

After execution of the Steam_Machine_Checker.exe, it opens the GUI screen of “Steam Machine Brute Force checker” in the frontend and starts its malicious activity in the backend.

the RunPE method and VM/Debugger/Sandbox detection code are taken from CSharp-RunPE

Instead it overwrites the original content of the files with a marker... Osno is a wiper in its current form and payment will not help to get any files back.

the RunPE method and VM/Debugger/Sandbox detection code are taken from CSharp-RunPE and Anti-Analysis by NYAN-x-CAT

The rootkit uses MinHook to redirect WinAPI calls, so that it hides processes and file names, e.g., from explorer and taskmanager.

Osno registers the rootkit DLL to AppInit_DLLs and enables LoadAppInit_DLLs so it is loaded with every process. Because the rookit DLLs are not signed, it sets RequireSignedAppInit_DLLs to 0.

Just like that version, Osno will force Discord to load JScript files inject.js and discordmod.js ... Discord will then act as a stealer.

Stolen data, placed in %TEMP%\<md5(username)>Osno\<md5(machinename)>-Logs Chromium Logins.txt Cookies.txt Gecko Logins.txt Direct Login Cookies.txt CreditCards.txt

Just like that version, Osno will force Discord to load JScript files inject.js and discordmod.js ... Discord will then act as a stealer.

Osno collects all accessible IP adresses in the local network

MSBuild.exe steals bookmarks, wallets, list of running process (using tasklist.exe), hardware and software installed – Anti-Virus, firewall etc.

MSBuild.exe steals bookmarks, wallets, list of running process (using tasklist.exe), hardware and software installed – Anti-Virus, firewall etc.

MSBuild.exe also gets a list of all the stored files present in each directory. It is then stored in the subfolder ‘Dirs’ as Desktop.txt, Documents.txt, Downloads.txt, OneDrive.txt, Pictures.txt, Startup.txt, Temp.txt and Videos.txt.

the RunPE method and VM/Debugger/Sandbox detection code are taken from CSharp-RunPE and Anti-Analysis by NYAN-x-CAT

Osno executes the following command for every collected IP and domain: <sharpexec> -m=psexec -i=<collected-ip> -d=<collected-domain> -f=<path-in:%TEMP%/gpustats.bx> -e=%TEMP%/<randomname>

Osno collects all accessible IP adresses in the local network, then downloads SharpExec binaries from Github... This command attempts to upload Osno to the given IP into the %TEMP% folder and executes it.

It also downloads CommandCam.exe from hxxp[:]//raw[.]githubusercontent[.]com/tedburke/CommandCam/master/CommandCam[.]exe for capturing screenshots of the system. The screenshot is saved as screen.jpg

Another tool that this Osno sample uses is Da pure C++ Clipper. A native binary for clipbanking.

It also downloads CommandCam.exe from hxxp[:]//raw[.]githubusercontent[.]com/tedburke/CommandCam/master/CommandCam[.]exe for capturing screenshots of the system.

_CL_02f3a8c9sy has base64 encoded data.

Additional user for RDP access, password "5Z6aW8qRhLWEwS" Defaultuzer

It then sends the stolen data in temp via telegram using ‘sendDocument’ of Telegram Bot API.

Future versions of Osno might use the already implemented XXTEA to encrypt files.

Along with the stealer and BTC Clipboard Hijacking, it also does coin mining.

Osno adds its own path and the root of drive C: as exclusion folder for Windows Defender... Osno searches for Window titles and process names to kill the processes of Antivirus software.