March 9, 2025
Proactive Defense: The Importance of Incident Response Planning in Cybersecurity
Rewterz Threat Alert – Agent Tesla Malware – Active IOCs
October 12, 2021Rewterz Threat Alert – DanaBot Trojan – Active IOCs
October 12, 2021Rewterz Threat Alert – Agent Tesla Malware – Active IOCs
October 12, 2021Rewterz Threat Alert – DanaBot Trojan – Active IOCs
October 12, 2021
Severity
High
Analysis Summary
An emergent and effective data-harvesting tool dubbed Oski is proliferating in North America and China, stealing online account credentials, credit card numbers, crypto wallet accounts, and more. The malware is still in its developing phase but packs a punch with its capabilities. Oski C2’s dashboard revealed that Oski’s theft tactics involve extracting credentials using man-in-the-browser (MitB) attacks by hooking the browser processes using DLL injection, It also extracts credentials from the registry, passwords from the browser SQLite database, and stored session cookies of all stripes, including crypto-wallet cookies from Bitcoin Core, Ethereum, Monero, Litecoin, and others.
Impact
- Credential Theft
- Unauthorized Access
Indicators of Compromise
MD5
- dff809a78dd6f4fb85fbd4e027288bf5
- 7f1e82a4456f08a250e231978b611ced
- d6665c8d306adf5bad8dd4814e45489a
- 958327f65e87da599ad05ad82897f730
SHA-256
- 1f61c1f18ee87194b914ebca512769c0cdc722f2b2ef40eed3ec8617770d6973
- 136a24bbf74b38d2b898d3188864ff81134d05b1a7ee7aa4cf566d127a04a4ec
- bcbbe4233cef8c278da1d912b78a646958cef0297a60dd5b54fd52a7c985825a
- 652ff7f52f0e2d6bdd5a0f36f4b24c4dafc8aab7d5236db91b77267650cdb140
SHA-1
- 9c29d3f92d6f8b2109650a1a5563091635a00733
- 08e7c174a514af301bb59bea22ebf54f64862c85
- a37a4a793f53e042b6529c2ba69674aa1ae899c3
- 3bf2631dd0877733ec2a005b7de033bb468fb2ca
Remediation
- Block all threat indicators at your respective controls.
- Always be suspicious about emails sent by unknown senders.
- Never click on the links/attachments sent by unknown senders.
- Search for IOCs in your environment.