onlylogger

General

Target

psiphon3.exe
Size

6.8MB
Sample

220128-xzannsbcgk
MD5

2ebc28739e3c11341136fc5404c44579
SHA1

6adb43880cac3dfe5a5356d19d588648739763e7
SHA256

fa2ff0f2de91ce2de9ac142cdffb56ec1716c9e16f561cda689f4f2010eceeb4
SHA512

c296a128487eb6fe393296b38ea290e7e2bdc7dce3dddcdc3f32d709da04e1b3bb488f3dcf1b0d9b36b937a867fd3d1f7b3c14131219875aa60a29339ac8c6f1

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://abpa.at/upload/

http://emaratghajari.com/upload/

http://d7qw.cn/upload/

http://alumik-group.ru/upload/

http://zamkikurgan.ru/upload/

rc4.i32

Extracted

Family

redline

Botnet

media272256

C2

92.255.57.115:11841

Targets

- Target
  
  psiphon3.exe
- Size
  
  6.8MB
- MD5
  
  2ebc28739e3c11341136fc5404c44579
- SHA1
  
  6adb43880cac3dfe5a5356d19d588648739763e7
- SHA256
  
  fa2ff0f2de91ce2de9ac142cdffb56ec1716c9e16f561cda689f4f2010eceeb4
- SHA512
  
  c296a128487eb6fe393296b38ea290e7e2bdc7dce3dddcdc3f32d709da04e1b3bb488f3dcf1b0d9b36b937a867fd3d1f7b3c14131219875aa60a29339ac8c6f1
Score

10^/10

onlylogger redline smokeloader socelars media272256 backdoor discovery evasion infostealer loader persistence spyware stealer suricata trojan
- OnlyLogger
  A tiny loader that uses IPLogger to get its payload.
  loader onlylogger
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
- suricata: ET MALWARE ClipBanker Variant Activity (POST)
  suricata: ET MALWARE ClipBanker Variant Activity (POST)
  suricata
- suricata: ET MALWARE Danabot Key Exchange Request
  suricata: ET MALWARE Danabot Key Exchange Request
  suricata
- suricata: ET MALWARE GCleaner Downloader Activity M5
  suricata: ET MALWARE GCleaner Downloader Activity M5
  suricata
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- OnlyLogger Payload
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- Sets service image path in registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
- Program crash
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2 behavioral3