March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – Snake Keylogger’s Malware – Active IOCs
April 8, 2022
Rewterz Threat Alert – Qakbot (Qbot) Malware – Active IOCs
April 8, 2022
Rewterz Threat Alert – Snake Keylogger’s Malware – Active IOCs
April 8, 2022
Rewterz Threat Alert – Qakbot (Qbot) Malware – Active IOCs
April 8, 2022
Severity
High
Analysis Summary
An emergent and effective data-harvesting tool dubbed Oski is proliferating in North America and China, stealing online account credentials, credit card numbers, crypto wallet accounts, and more. The malware is still in its developing phase but packs a punch with its capabilities. Oski C2’s dashboard revealed that Oski’s theft tactics involve extracting credentials using man-in-the-browser (MitB) attacks by hooking the browser processes using DLL injection, It also extracts credentials from the registry, passwords from the browser SQLite database, and stored session cookies of all stripes, including crypto-wallet cookies from Bitcoin Core, Ethereum, Monero, Litecoin, and others.
Impact
- Credential Theft
- Unauthorized Access
Indicators of Compromise
MD5
- 2df2bb4ba1e6580fa4368f8b2cf681fe
SHA-256
- 24135e78ecf7c7e30984c0f38d381f528c2400f4b7f4a05d5c37bdcf9365ced1
SHA-1
- f47e87ba69f94bf626c27bde2708fd2686df203b
Remediation
- Search for IOCs in your environment.
- Block all threat indicators at your respective controls.