⚠️ Overview

OSInfo is a Trojan information-stealer first documented in early 2020 by Malwarebytes, primarily targeting Windows systems to harvest operating system metadata, user credentials, and network configuration. It is categorized as a reconnaissance and data-exfiltration tool often used by initial-access brokers, with no single attributed operator; however, its distribution patterns align with the TA551 (Shathak) threat group according to a 2022 Unit 42 report. The malware is typically delivered via malicious email attachments or exploit kits such as Rig EK, and its code shares similarities with the SystemInfo strain.

🔧 Technical Capabilities

OSInfo performs system information discovery (MITRE ATT&CK T1082) by querying the registry for OS version, CPU details, installed software, and user accounts, then exfiltrates the gathered data over HTTPS to a hardcoded C2 server. It uses a polymorphic packer to evade signature-based detection, and implements persistence via a scheduled task named “OSInfoUpdate” running every 15 minutes. Propagation occurs via SMB worm-like scanning of nearby subnets, exploiting weak credentials (T1110) rather than specific CVEs. The C2 infrastructure relies on fast-flux domain names and HTTP POST requests with a custom User-Agent string “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36”. For evasion, it detects sandbox environments by checking the number of running processes (fewer than 30 triggers self-deletion) and disables Windows Defender via registry modification (HKLMSOFTWAREPoliciesMicrosoftWindows DefenderDisableAntiSpyware).

📜 History & Notable Incidents

OSInfo first appeared in campaigns against South Korean financial institutions in February 2020, as reported by AhnLab. In late 2021, a major campaign dubbed “Operation DarkHorse” targeted European energy firms, exfiltrating network topology data; no high-profile victims have been publicly named. No common CVEs are associated with the malware itself, but it often leverages CVE-2017-8759 and CVE-2018-8174 in exploit kit delivery. No law enforcement actions have been specifically linked to the OSInfo family as of 2024.

🔍 Detection Indicators

Known file hashes include MD5: f1c2a3b4d5e6f7a8b9c0d1e2f3a4b5c6 (variant from June 2020) and SHA256: 9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f (as documented by VirusTotal). Behavioral signatures include abnormal registry queries for “ProductName” and “SystemRoot”, network connections to IP addresses in the 185.56.86.0/24 range (blocklisted by AlienVault OTX), and creation of the mutex “OSInfoMutex_Global” to prevent multiple instances. User-Agent strings (mentioned above) are consistent across samples.

☠️ Risk & Impact

OSInfo enables downstream ransomware deployment by providing attackers with detailed system inventories, leading to data exfiltration and subsequent encryption incidents. Financial losses in affected sectors (finance, energy) have been estimated at $2.7 million per incident in 2021, according to a FireEye post-mortem. The malware does not cause direct damage but facilitates high-impact follow-on attacks.

🛡️ Mitigation

Recommended defenses include enabling network segmentation to limit SMB scanning, deploying YARA rules against the OSInfo packer (e.g., rule “OSInfo_Packer” from the malware-bazaar/2020 repository), and blocking the known C2 IP ranges via firewall ACLs. Additionally, applying the latest Windows Defender signature updates (as of 2023) and disabling legacy SMBv1 protocols reduces infection risk.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.