March 20, 2025
Proactive Defense: The Importance of Incident Response Planning in Cybersecurity
Rewterz Threat Alert – Cobalt Strike Malware – Active IOCs
January 9, 2023Rewterz Threat Alert – Chaos Ransomware – Active IOCs
January 9, 2023Rewterz Threat Alert – Cobalt Strike Malware – Active IOCs
January 9, 2023Rewterz Threat Alert – Chaos Ransomware – Active IOCs
January 9, 2023
Severity
High
Analysis Summary
The Oski stealer is a malicious data stealer that was originally discovered in November 2019. This successful data-harvesting tool is spreading throughout North America and China, gathering account passwords, credit card information, and other sensitive data. This form of malware is still one of the most common types of malware employed in cyber-attacks. The dashboard of Oski C2 reveals that Oski’s stealing strategies include utilizing man-in-the-browser (MitB) attacks to extract passwords via hijacking browser processes using DLL injection. According to research, this data thief is spread via fraudulent websites that are opened as a result of a router’s DNS settings being hijacked.
Impact
- Credential Thefts
- Unauthorized Access
- Information Theft
Indicators of Compromise
MD5
- c927fbf0a308f0a52924210896ab4efa
SHA-256
- a1fb5c784bc7054210483191ef7a6c47da443b4283442de4eb0d297bce669751
SHA-1
- 6e139eeb5094862192d5f260b2a62beec9b910f4
Remediation
- Search for IOCs in your environment.
- Block all threat indicators at your respective controls.