onlylogger

Sharing

General

Target

ba7889732bce71b8a82fbbe0eda1bd964c5ecb5f6ca415a1d9c9d20cf58ead84
Size

3.1MB
Sample

220314-vdwynscabn
MD5

f111930958a804ce132c578cd08fe763
SHA1

bfd7e49e0a183aa82a03a06e2761bb8ce750c569
SHA256

ba7889732bce71b8a82fbbe0eda1bd964c5ecb5f6ca415a1d9c9d20cf58ead84
SHA512

13afc2e9530ac09ec62e9c51e91016d9972b5a1a70e6479621fcfbe99e779012ce04ddf21a819b2110abb2e36f626276bda4038b9a7440042a51d42b7a3278b2

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

ServAni

87.251.71.195:82

Extracted

Family

redline

Botnet

da da

86.107.197.196:63065

Attributes

auth_value
9b1654b30797c210c85bd0890936a5b9

Extracted

Family

redline

Botnet

ruzki14_03

176.122.23.55:11768

Attributes

auth_value
13b742acfe493b01c5301781c98d3fbe

Extracted

Family

vidar

Version

50.7

Botnet

1177

https://ruhr.social/@sam9al

https://koyu.space/@samsa2l

Attributes

profile_id
1177

Extracted

Family

vidar

Version

39.4

Botnet

706

https://sergeevih43.tumblr.com/

Attributes

profile_id
706

Extracted

Family

redline

5.206.224.220:81

Attributes

auth_value
4330eefe7c0f986c945c8babe3202f28

Targets

- Target
  
  ba7889732bce71b8a82fbbe0eda1bd964c5ecb5f6ca415a1d9c9d20cf58ead84
- Size
  
  3.1MB
- MD5
  
  f111930958a804ce132c578cd08fe763
- SHA1
  
  bfd7e49e0a183aa82a03a06e2761bb8ce750c569
- SHA256
  
  ba7889732bce71b8a82fbbe0eda1bd964c5ecb5f6ca415a1d9c9d20cf58ead84
- SHA512
  
  13afc2e9530ac09ec62e9c51e91016d9972b5a1a70e6479621fcfbe99e779012ce04ddf21a819b2110abb2e36f626276bda4038b9a7440042a51d42b7a3278b2
Score

10^/10

onlylogger redline tofsee da da ruzki14_03 servani aspackv2 evasion infostealer loader persistence spyware stealer suricata trojan upx vidar 1177 706
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- OnlyLogger
  A tiny loader that uses IPLogger to get its payload.
  loader onlylogger
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Tofsee
  Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
  trojan tofsee
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- suricata: ET MALWARE GCleaner Downloader Activity M5
  suricata: ET MALWARE GCleaner Downloader Activity M5
  suricata
- suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
  suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
  suricata
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- OnlyLogger Payload
- Vidar Stealer
  stealer
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

New Service

T1050

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

Modifies Windows Defender Real-time Protection settings

RedLine

RedLine Payload

Suspicious use of NtCreateUserProcessOtherParentProcess

Tofsee

Vidar

suricata: ET MALWARE GCleaner Downloader Activity M5

suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

Identifies VirtualBox via ACPI registry values (likely anti-VM)

OnlyLogger Payload

Vidar Stealer

ASPack v2.12-2.42

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

UPX packed file

Checks BIOS information in registry

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Adds Run key to start application

Checks whether UAC is enabled

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2