onlylogger

General

Target

b1e14b258c13096cfe421fa0d5b090551ed0b3228cbb09a42f96d125afa9dbb9
Size

5.6MB
Sample

220714-f9a9hsgacp
MD5

47c5753cd047423b75d749af44694caa
SHA1

c73820121b00a6deb40ba9ad00b6a05fd051cd89
SHA256

b1e14b258c13096cfe421fa0d5b090551ed0b3228cbb09a42f96d125afa9dbb9
SHA512

6ac94d3de8bdb14a969059bf611c9c9b12fdb6d810fa654c21a01707a0000f2ca6a81ce2adea26eba6a6fa7952bc6b17f63335e5c95aadd6b8bca78ca3a14e5e

Score

10^/10

Malware Config

Extracted

Family

socelars

C2

https://sa-us-bucket.s3.us-east-2.amazonaws.com/usahd1/

Extracted

Family

redline

Botnet

media4040

C2

92.255.57.154:11841

Attributes

auth_value
a50ae9321733f8c0d2bef1fa701fd46b

Targets

- Target
  
  b1e14b258c13096cfe421fa0d5b090551ed0b3228cbb09a42f96d125afa9dbb9
- Size
  
  5.6MB
- MD5
  
  47c5753cd047423b75d749af44694caa
- SHA1
  
  c73820121b00a6deb40ba9ad00b6a05fd051cd89
- SHA256
  
  b1e14b258c13096cfe421fa0d5b090551ed0b3228cbb09a42f96d125afa9dbb9
- SHA512
  
  6ac94d3de8bdb14a969059bf611c9c9b12fdb6d810fa654c21a01707a0000f2ca6a81ce2adea26eba6a6fa7952bc6b17f63335e5c95aadd6b8bca78ca3a14e5e
Score

10^/10

onlylogger socelars aspackv2 loader spyware stealer suricata upx redline media4040 infostealer
- OnlyLogger
  A tiny loader that uses IPLogger to get its payload.
  loader onlylogger
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- suricata: ET MALWARE ClipBanker Variant Activity (POST)
  suricata: ET MALWARE ClipBanker Variant Activity (POST)
  suricata
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- OnlyLogger payload
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Drops Chrome extension
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2