onlylogger

General

Target

562a34ab385f912a2d9dcb99beebf634188ed3b1f09fcec7a0c121f7b9beb48c
Size

4.4MB
Sample

220725-fyf1magdan
MD5

26150f2eaabfa57ee2c672a111fd8aa4
SHA1

bf4c2a6b9ccd3ce8d34f505efbae40287e0b671b
SHA256

562a34ab385f912a2d9dcb99beebf634188ed3b1f09fcec7a0c121f7b9beb48c
SHA512

a7a1aa2c4df6d708b5449d6aa7a11a7a594fcefa31006f029e1a2432552ee8de47328313071710a4828c4e1d45821dcbefb9a03d35f796ee9ef6941101418665

Score

10^/10

Malware Config

Extracted

Family

socelars

C2

http://www.tpyyf.com/

Targets

- Target
  
  562a34ab385f912a2d9dcb99beebf634188ed3b1f09fcec7a0c121f7b9beb48c
- Size
  
  4.4MB
- MD5
  
  26150f2eaabfa57ee2c672a111fd8aa4
- SHA1
  
  bf4c2a6b9ccd3ce8d34f505efbae40287e0b671b
- SHA256
  
  562a34ab385f912a2d9dcb99beebf634188ed3b1f09fcec7a0c121f7b9beb48c
- SHA512
  
  a7a1aa2c4df6d708b5449d6aa7a11a7a594fcefa31006f029e1a2432552ee8de47328313071710a4828c4e1d45821dcbefb9a03d35f796ee9ef6941101418665
Score

10^/10

onlylogger socelars loader stealer xmrig miner spyware
- OnlyLogger
  A tiny loader that uses IPLogger to get its payload.
  loader onlylogger
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars payload
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- OnlyLogger payload
- XMRig Miner payload
  miner
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2