onlylogger

General

Target

28d71a579fb75cb672af489ce602392b4504f895c3881691a12c51cea7719f4d
Size

10.3MB
Sample

220615-tsbevahga9
MD5

08e90fc1c73b4e71c070073d89ce10e8
SHA1

f609773ff73bf40fc8b5f965ad6fdd2fa1e052e0
SHA256

28d71a579fb75cb672af489ce602392b4504f895c3881691a12c51cea7719f4d
SHA512

72f9954291c99e8f91574bd22e24682acb2d8649c84c56be55765104015666f0a2bf33b0a731ad43be654c85c7488be26004693694703da3b2ff8d8909789581

Score

10^/10

Malware Config

Extracted

Family

socelars

C2

http://www.mkpmc.com/

Targets

- Target
  
  28d71a579fb75cb672af489ce602392b4504f895c3881691a12c51cea7719f4d
- Size
  
  10.3MB
- MD5
  
  08e90fc1c73b4e71c070073d89ce10e8
- SHA1
  
  f609773ff73bf40fc8b5f965ad6fdd2fa1e052e0
- SHA256
  
  28d71a579fb75cb672af489ce602392b4504f895c3881691a12c51cea7719f4d
- SHA512
  
  72f9954291c99e8f91574bd22e24682acb2d8649c84c56be55765104015666f0a2bf33b0a731ad43be654c85c7488be26004693694703da3b2ff8d8909789581
Score

10^/10

onlylogger socelars discovery loader spyware stealer suricata
- OnlyLogger
  A tiny loader that uses IPLogger to get its payload.
  loader onlylogger
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars Payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- suricata: ET MALWARE ClipBanker Variant Activity (POST)
  suricata: ET MALWARE ClipBanker Variant Activity (POST)
  suricata
- OnlyLogger Payload
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2