Severity
High
Analysis Summary
An emergent and effective data-harvesting tool dubbed Oski is proliferating in North America and China, stealing online account credentials, credit card numbers, crypto wallet accounts, and more. The malware is still in its developing phase but packs a punch with its capabilities. Oski C2’s dashboard revealed that Oski’s theft tactics involve extracting credentials using man-in-the-browser (MitB) attacks by hooking the browser processes using DLL injection, It also extracts credentials from the registry, passwords from the browser SQLite database, and stored session cookies of all stripes, including crypto-wallet cookies from Bitcoin Core, Ethereum, Monero, Litecoin, and others.
Impact
- Credential theft
- Information disclosure
Indicators of Compromise
MD5
- 6581f25476a8e4009877ba7498489ef6
- c659765bca12e5c5532fd8b85b4793a7
- 1e3efd26f966bca4f18c36d64fa21341
- 9f6f8cb5647da0fc5df0142e82ac12ee
SHA-256
- 808910839d0446439d58dbff8bf7d36db24892fb0ebd018a9dcafc24ddd9d34c
- 017c0459b56b7e178721e18438dc793bbf2cd6cfe14481716a62441efcda3f0c
- bed7bde808f7f069703d1655dd9762ec3744f7d991218654f2f6f41fc6383e6d
- fac2fa827e763dfcc0b5baf189dd050db2dae4d731ec54a208c2238d4f7b55e9
SHA1
- dbacf300333c598ebd34e57228efc569cadee154
- f6c72b749ba83c5bd4442e8b490cdba941068546
- 1461c5cf12989068b1afd4bdd0514850ab99b188
- 1d3d073bdaac0cb8e59f90e13bb686a9602f6da6
Remediation
- Block all threat indicators at your respective controls.
- Always be suspicious about emails sent by unknown senders.
- Never click on the links/attachments sent by unknown senders