onlylogger

General

Target

b1eb7d97d87b9e894a83a23f033777aa.exe
Size

9.4MB
Sample

220124-n72bxseef6
MD5

b1eb7d97d87b9e894a83a23f033777aa
SHA1

a9bfb137114e9ba56d7a36ae3cc2ab1aa54f742a
SHA256

800175a19a10dae3a8acbbfec1291416b5babb144cbedd017c5a75c816687381
SHA512

9f0abc5533f8790e0a6b11c7dc20d8f41756803b300ccf1b4282f3c765de85cbb06c565825ff7a04d65e44edb6f9b10981a43dc11310908f2af41d70ef97e3fe

Score

10^/10

Malware Config

Extracted

Family

socelars

C2

http://www.biohazardgraphics.com/

Extracted

Family

raccoon

Botnet

8fc55a7ea41b0c5db2ca3c881e20966100c28a40

Attributes

url4cnc
http://194.180.174.53/jredmankun
http://91.219.236.18/jredmankun
http://194.180.174.41/jredmankun
http://91.219.236.148/jredmankun
https://t.me/jredmankun

rc4.plain

Extracted

Family

redline

Botnet

media23nps

C2

65.108.69.168:13293

Extracted

Family

vidar

Version

49.2

Botnet

915

C2

https://mstdn.social/@kipriauk9

https://qoto.org/@kipriauk8

Attributes

profile_id
915

Extracted

Family

raccoon

rc4.plain

Extracted

Family

redline

Botnet

v3user1

C2

159.69.246.184:13127

Targets

- Target
  
  b1eb7d97d87b9e894a83a23f033777aa.exe
- Size
  
  9.4MB
- MD5
  
  b1eb7d97d87b9e894a83a23f033777aa
- SHA1
  
  a9bfb137114e9ba56d7a36ae3cc2ab1aa54f742a
- SHA256
  
  800175a19a10dae3a8acbbfec1291416b5babb144cbedd017c5a75c816687381
- SHA512
  
  9f0abc5533f8790e0a6b11c7dc20d8f41756803b300ccf1b4282f3c765de85cbb06c565825ff7a04d65e44edb6f9b10981a43dc11310908f2af41d70ef97e3fe
Score

10^/10

onlylogger raccoon redline socelars vidar 8fc55a7ea41b0c5db2ca3c881e20966100c28a40 915 media23nps aspackv2 infostealer loader stealer v3user1 evasion persistence spyware trojan
- OnlyLogger
  A tiny loader that uses IPLogger to get its payload.
  loader onlylogger
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars Payload
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- OnlyLogger Payload
- Vidar Stealer
  stealer
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Downloads MZ/PE file
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2