✕

Rewterz Annual Threat Intelligence Report 2025 - Download Now

Request a Demo
Rewterz

Rewterz Threat Alert – ICS Focused Malware – Havex

July 21, 2021
Rewterz

Rewterz Threat Advisory –Multiple Citrix ADC and Gateway Vulnerabilities

July 21, 2021

Rewterz Threat Alert –MosaicLoader – New Malware Hides Itself Among Windows Defender Exclusions to Evade Detection

Severity

Medium

Analysis Summary

Researchers have identified a new family of malware while investigating processes that add local exclusions in Windows Defender for specific file names. MosaicLoader is seemingly delivered through paid ads in search results designed to lure users looking for cracked software to infect their devices. Once planted on the system, the malware creates a complex chain of processes and tries to download a variety of threats, from simple cookie stealers, crypto-currency miners to fully-fledged backdoors such as Glupteba.

windows computer malware

Impact

  • Session hijack
  • Cookies stealer
  • Crypto-currency miners

Indicators of Compromise

MD5

  • d724066d7c19b29b2bdb7468a9027f1b
  • 953ebbee1cc0fe28595ef92277ee1824
  • d9ecaa2b2ac1902805ca96b7f6803028
  • 62828deec03544193a8b7af50b587c64
  • 51ef12de306029e18ad25802b0acfbb2
  • dd2d93e538f05295700a371976b057c9
  • f3481078c22a26ecd6ab9f653e6be075
  • 09ca3264faa0092b6704bf77e72fa5df
  • 91f545054d5188d0a61e9aa39f38f02d
  • d7a8d70022085464f05888ef6575d8ec
  • bda968ba8dc4a7351f1af40549e87713
  • fe5d1d2a2a9a4b61d237546d5896599e
  • 90070741e9c025f841f47f0c3adee3d2
  • cd6e4a9e65bd9e1e3aae77400161ead0
  • 74f40695d6e8b7554652a2ccab0e24e4
  • c2595f372f0c55e3add27b1987ab7273
  • bb31f608469d58ccd816033dc5740942
  • f08910c2927c583531dd1da85d3644b4

Remediation

  • Do not download and install applications from untrusted websites.
  • Always download software and applications from legitimate sources.
  • Keep your software updated to the latest patches available

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo