The malware called OriginLogger has recently been dissected in detail by security experts from Palo Alto Networks Unit 42. It is believed that OriginLogger is destined to replace Agent Tesla, and this is a widely used info-stealer and RAT.
Tesla is a keylogger and remote access tool that is based on .NET. This malware allows its operators easy access to target systems remotely and sends sensitive data to a C2 controlled by the actor.
It has been available for sale on dark web forums since 2014 and is known to have been used in the wild since then. Malicious spam emails with attachments are generally used to distribute this virus.
OriginLogger
The commodity malware (versions 2, 3) was disclosed by cybersecurity firm Sophos in February 2021. These versions featured capabilities to steal credentials from:-
- Web browsers
- Email apps
- VPN clients
- Telegram
A claim is being made that version 3 of Agent Tesla is actually OriginLogger, and that is based on some information.
A YouTube video detailing the features of the cybersecurity firm that was posted in November 2018 is the starting point of the cybersecurity firm’s investigation.
Consequently, the VirusTotal malware database was searched for a malware sample that was uploaded on May 17, 2022 entitled OriginLogger.exe and that was in the possession of VirusTotal.
OriginLogger Features
As a builder binary, the executable provides customers with the following features as part of its functionality:-
- Multi-Language Support
- 3 Different Delivery: PHP, SMTP, and FTP
- Keylogger
- Colored Log
- Screenshot Logger
- Multi File Binder
- Clipboard Logger
- SmartLogger
- Password Recovery
- Web Panel
- 7/24 Support
- Fake Message
- Autobuy
- Stable and Fast
- Pure Code
- All Windows OS Supported
- UAC Bypass: Win 7/8/10
- Assembly & Icon Option
As part of the authentication process, a request is sent to the OriginLogger server in order to verify the identity of the user. The following domain names resolve to the following addresses:-
- 0xfd3[.]com
- originpro[.]me
As a result of the investigation by Unit 42, a GitHub profile with the username 0xfd3 was identified. During the course of the investigation, it has been detected that two source code repositories were hosted by this profile. While they are used for stealing passwords from the following platforms by exploiting OrionLogger:-
- Google Chrome
- Microsoft Outlook
A decoy Microsoft Word document is used to deliver OrionLogger to victims, just as Agent Tesla does. The document contains a number of Excel Worksheets that are embedded into it.
One of which contains an image of a passport of a German citizen, along with one that displays a credit card, and it also contains copies of the passports.
In addition, each of the worksheets contains a VBA macro that calls the HTML page that is hosted on a remote server once the worksheets are loaded.
In many ways, OriginLogger and Agent Tesla are similar keyloggers. OriginLogger, however, is a commoditized keylogger.
