March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – Agent Tesla Malware – Active IOCs
September 17, 2021
Rewterz Threat Advisory – Multiple Apache Jena and HTTP Server Vulnerabilities
September 17, 2021
Rewterz Threat Alert – Agent Tesla Malware – Active IOCs
September 17, 2021
Rewterz Threat Advisory – Multiple Apache Jena and HTTP Server Vulnerabilities
September 17, 2021
Severity
High
Analysis Summary
An emergent and effective data-harvesting tool dubbed Oski is proliferating in North America and China, stealing online account credentials, credit card numbers, crypto wallet accounts, and more. The malware is still in its developing phase but packs a punch with its capabilities. Oski C2’s dashboard revealed that Oski’s theft tactics involve extracting credentials using man-in-the-browser (MitB) attacks by hooking the browser processes using DLL injection, It also extracts credentials from the registry, passwords from the browser SQLite database, and stored session cookies of all stripes, including crypto-wallet cookies from Bitcoin Core, Ethereum, Monero, Litecoin, and others.
Impact
- Credential Theft
- Unauthorized Access
Indicators of Compromise
MD5
- 5d8d890614b10708afe877fb67a3e65b
- 16e153201be41825d56aaeac47183efd
SHA-256
- e65c6e141516a7d76fe7c1e3bcc5433758fa627dfd6c18f65504efcfa62d4855
- 930ad6fbbfbac743f4097748a7af399d3fbb61b1ba36bc6230803dcdfb357640
SHA-1
- 102b326899fbb5a2e6c03fcfb8e401c5c3a72f78
- 980367f1702c355961144c8f5cd6444c1f58baa8
Remediation
- Block all threat indicators at your respective controls.
- Always be suspicious about emails sent by unknown senders.
- Never click on the links/attachments sent by unknown senders.
- Search for IOCs in your environment.