The malware called OriginLogger has recently been dissected in detail by security experts from Palo Alto Networks Unit 42. It is believed that OriginLogger is destined to replace Agent Tesla, and this is a widely used info-stealer and RAT.
Tesla is a keylogger and remote access tool that is based on .NET. This malware allows its operators easy access to target systems remotely and sends sensitive data to a C2 controlled by the actor.
It has been available for sale on dark web forums since 2014 and is known to have been used in the wild since then. Malicious spam emails with attachments are generally used to distribute this virus.
The commodity malware (versions 2, 3) was disclosed by cybersecurity firm Sophos in February 2021. These versions featured capabilities to steal credentials from:-
A claim is being made that version 3 of Agent Tesla is actually OriginLogger, and that is based on some information.
A YouTube video detailing the features of the cybersecurity firm that was posted in November 2018 is the starting point of the cybersecurity firm’s investigation.
Consequently, the VirusTotal malware database was searched for a malware sample that was uploaded on May 17, 2022 entitled OriginLogger.exe and that was in the possession of VirusTotal.
As a builder binary, the executable provides customers with the following features as part of its functionality:-
As part of the authentication process, a request is sent to the OriginLogger server in order to verify the identity of the user. The following domain names resolve to the following addresses:-
As a result of the investigation by Unit 42, a GitHub profile with the username 0xfd3 was identified. During the course of the investigation, it has been detected that two source code repositories were hosted by this profile. While they are used for stealing passwords from the following platforms by exploiting OrionLogger:-
A decoy Microsoft Word document is used to deliver OrionLogger to victims, just as Agent Tesla does. The document contains a number of Excel Worksheets that are embedded into it.
One of which contains an image of a passport of a German citizen, along with one that displays a credit card, and it also contains copies of the passports.
In addition, each of the worksheets contains a VBA macro that calls the HTML page that is hosted on a remote server once the worksheets are loaded.
In many ways, OriginLogger and Agent Tesla are similar keyloggers. OriginLogger, however, is a commoditized keylogger.
As explained in the initial lure document, commercial keyloggers tend to cater to less advanced and sophisticated threat actors. There is a great deal of caution that should be applied to commercial keyloggers in the same manner that one would treat malicious software.
Download SWG – Secure Web Filtering – Free E-book
Best DNS Management Tools play a crucial role in efficiently managing domain names and their…
Customers can now easily integrate Sweet’s runtime detection and response platform into their AWS environments…
Cybercriminals exploit leaked credentials, obtained through various means, to compromise systems and data, enabling them…
SpyAgent, a newly discovered Android malware, leverages OCR technology to extract cryptocurrency recovery phrases from…
In late October 2024, a coordinated IP spoofing attack targeted the Tor network, prompting abuse…
The Metasploit Framework, a widely used open-source penetration testing tool maintained by Rapid7, has introduced…