Oski is a C++ stealer that appeared around November 2019 and was sold on Russian-language forums for roughly $70 to $100. It collects wallets, saved passwords and files matching attacker-defined patterns, zips everything and uploads it to the panel.
Unpacking a .NET-wrapped sample
The sample I worked on was delivered through a .NET wrapper with several stages. The routine was always the same.
1. find the lowest Invoke() call, set a breakpoint, run
2. stage 1 module appears (named like a framework attribute class)
3. run again, break on InvokeMethod() -> next module appears
(GetRuntimeDirectory is a distraction, step out)
4. land in user code, walk to the function that loads the PE
5. memory view shows an MZ header -> dump it to disk
The stage names are deliberately mundane, borrowed from legitimate .NET libraries, which is why they blend into a quick scan of the module list.
Result
The dumped executable is the native stealer. Its server address in this case was a free-TLD domain.
Notes
- The two intermediate assemblies do not store the payload in an obvious resource; they only reconstruct it in memory.
- Setting breakpoints at InvokeMethod is a small shortcut that works for many .NET loader families.