March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – Cerberus Banking Trojan – Active IOCs
December 7, 2021
Rewterz Threat Alert – SNAKE Ransomware – Active IOCs
December 7, 2021
Rewterz Threat Alert – Cerberus Banking Trojan – Active IOCs
December 7, 2021
Rewterz Threat Alert – SNAKE Ransomware – Active IOCs
December 7, 2021
Severity
High
Analysis Summary
An emergent and effective data-harvesting tool dubbed Oski is proliferating in North America and China, stealing online account credentials, credit card numbers, crypto wallet accounts, and more. The malware is still in its developing phase but packs a punch with its capabilities. Oski C2’s dashboard revealed that Oski’s theft tactics involve extracting credentials using man-in-the-browser (MitB) attacks by hooking the browser processes using DLL injection, It also extracts credentials from the registry, passwords from the browser SQLite database, and stored session cookies of all stripes, including crypto-wallet cookies from Bitcoin Core, Ethereum, Monero, Litecoin, and others.
Impact
- Credential Theft
- Unauthorized Access
Indicators of Compromise
MD5
- e4833e975ec9a404fe636e8cece99172
- 83437762e281a39dd2e3d24a77bed412
- a989e8f8982eb3edd6684d790b22e48e
SHA-256
- e447edf7c703f03c3644f4d8b896974b7bfa59e7bc4036af5a800c7135dd09b0
- 79f2322a266f7ae7af5686670d8e8bc93661506340aab5e9d63fd23517bbbdd0
- 3d67ced8c8394bdc10e76835caea07dee4729e86bc665a970b6e1b5af6c33eaa
SHA-1
- 553c0807cc5b0df4b1a91ff2689636fde8f33d70
- c818383759ac632ba7b418e3a830d0a9e90b7cbb
- d9c024d4b196a282c7748f3c3e592d8248d71d3a
Remediation
- Block all threat indicators at your respective controls.
- Always be suspicious about emails sent by unknown senders.
- Never click on the links/attachments sent by unknown senders.
- Search for IOCs in your environment.