onlylogger

General

Target

48c87d79add451b66472393de6f3a8e84e6255c4d9079ff75c1a3bdf68e3c0f1
Size

6.8MB
Sample

220714-cbazbabdh8
MD5

cb0c20c584abe1f913ce3f66b5c1a168
SHA1

af93c1eac433b1534b98b061c05c7404b1265b4f
SHA256

48c87d79add451b66472393de6f3a8e84e6255c4d9079ff75c1a3bdf68e3c0f1
SHA512

bae0f257784c70dc6d905223fe4a98b5bdab2a81d3054c7255bd817949091c38f6b9f4a394ef71d016050c2d861cb33aca3cc311ead27d986777aef36eb8a723

Score

10^/10

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.efxety.top/

Extracted

Family

vidar

Version

41.6

Botnet

933

C2

https://mas.to/@lilocc

Attributes

profile_id
933

Targets

- Target
  
  48c87d79add451b66472393de6f3a8e84e6255c4d9079ff75c1a3bdf68e3c0f1
- Size
  
  6.8MB
- MD5
  
  cb0c20c584abe1f913ce3f66b5c1a168
- SHA1
  
  af93c1eac433b1534b98b061c05c7404b1265b4f
- SHA256
  
  48c87d79add451b66472393de6f3a8e84e6255c4d9079ff75c1a3bdf68e3c0f1
- SHA512
  
  bae0f257784c70dc6d905223fe4a98b5bdab2a81d3054c7255bd817949091c38f6b9f4a394ef71d016050c2d861cb33aca3cc311ead27d986777aef36eb8a723
Score

10^/10

onlylogger socelars vidar 933 discovery loader spyware stealer suricata
- OnlyLogger
  A tiny loader that uses IPLogger to get its payload.
  loader onlylogger
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- suricata: ET MALWARE ClipBanker Variant Activity (POST)
  suricata: ET MALWARE ClipBanker Variant Activity (POST)
  suricata
- suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses
  suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses
  suricata
- OnlyLogger payload
- Vidar Stealer
  stealer
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2