✕

Rewterz Annual Threat Intelligence Report 2025 - Download Now

Request a Demo
Rewterz

Rewterz Threat Alert – Cobalt Strike Malware – Active IOCs

January 9, 2023
Rewterz

Rewterz Threat Alert – Chaos Ransomware – Active IOCs

January 9, 2023

Rewterz Threat Alert – Oski Data Stealer Malware – Active IOCs

Severity

High

Analysis Summary

The Oski stealer is a malicious data stealer that was originally discovered in November 2019. This successful data-harvesting tool is spreading throughout North America and China, gathering account passwords, credit card information, and other sensitive data. This form of malware is still one of the most common types of malware employed in cyber-attacks. The dashboard of Oski C2 reveals that Oski’s stealing strategies include utilizing man-in-the-browser (MitB) attacks to extract passwords via hijacking browser processes using DLL injection. According to research, this data thief is spread via fraudulent websites that are opened as a result of a router’s DNS settings being hijacked.

Impact

  • Credential Thefts
  • Unauthorized Access
  • Information Theft

Indicators of Compromise

MD5

  • c927fbf0a308f0a52924210896ab4efa

SHA-256

  • a1fb5c784bc7054210483191ef7a6c47da443b4283442de4eb0d297bce669751

SHA-1

  • 6e139eeb5094862192d5f260b2a62beec9b910f4

Remediation

  • Search for IOCs in your environment.
  • Block all threat indicators at your respective controls.

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo