onlylogger

Target

b002c0162a0a0c83be1ebdb21c14c580.exe
Size

6.6MB
Sample

220131-pr7z7shgb5
MD5

b002c0162a0a0c83be1ebdb21c14c580
SHA1

96d424d27ead82288ef68fb02e7a7205a4254068
SHA256

ea2aba1a17de28fee1a6097e91c4ceb0f3887f6bbcce46dfe4d2e342b87bef9e
SHA512

7df2fd40b14992ea1a09a9efc61ae91c2e5fe49272855dc00542096070a6804fd1e06d0978f39c8fa1d35af51b4c4cb2ff66674e29da8cb82076bbb0ef5b371c

Score

10^/10

Malware Config

Extracted

Family

socelars

http://www.kvubgc.com/

Extracted

Family

redline

Botnet

Update

78.46.137.240:21314

Extracted

Family

redline

Botnet

media17223

92.255.57.115:59426

Extracted

Family

redline

Botnet

v2user1

88.99.35.59:63020

Extracted

Family

smokeloader

Version

2020

http://nahbleiben.at/upload/

http://noblecreativeaz.com/upload/

http://tvqaq.cn/upload/

http://recmaster.ru/upload/

http://sovels.ru/upload/

rc4.i32

Targets

- Target
  
  b002c0162a0a0c83be1ebdb21c14c580.exe
- Size
  
  6.6MB
- MD5
  
  b002c0162a0a0c83be1ebdb21c14c580
- SHA1
  
  96d424d27ead82288ef68fb02e7a7205a4254068
- SHA256
  
  ea2aba1a17de28fee1a6097e91c4ceb0f3887f6bbcce46dfe4d2e342b87bef9e
- SHA512
  
  7df2fd40b14992ea1a09a9efc61ae91c2e5fe49272855dc00542096070a6804fd1e06d0978f39c8fa1d35af51b4c4cb2ff66674e29da8cb82076bbb0ef5b371c
Score

10^/10

onlylogger redline smokeloader socelars media17223 update v2user1 aspackv2 backdoor infostealer loader spyware stealer trojan upx
- OnlyLogger
  A tiny loader that uses IPLogger to get its payload.
  loader onlylogger
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars Payload
- Suspicious use of NtCreateProcessExOtherParentProcess
- OnlyLogger Payload
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
- Suspicious use of SetThreadContext
behavioral1