Researchers Detail OriginLogger RAT — Successor to Agent Tesla Malware

Palo Alto Networks Device 42 has in-depth the interior workings of a malware identified as OriginLogger, which has been touted as a successor to the greatly applied information and facts stealer and remote entry trojan (RAT) recognized as Agent Tesla.

A .NET based mostly keylogger and distant access, Agent Tesla has had a lengthy-standing presence in the danger landscape, making it possible for malicious actors to gain remote entry to qualified methods and beacon delicate information to an actor-managed area.

Identified to be used in the wild since 2014, it can be advertised for sale on dark web community forums and is commonly dispersed as a result of malicious spam e-mail as an attachment.

In February 2021, cybersecurity business Sophos disclosed two new variants of the commodity malware (edition 2 and 3) that highlighted capabilities to steal qualifications from web browsers, email applications, and VPN clients, as nicely as use Telegram API for command-and-command.

Now in accordance to Unit 42 researcher Jeff White, what has been tagged as AgentTesla variation 3 is basically OriginLogger, which is claimed to have sprung up to fill the void still left by the former immediately after its operators shut store on March 4, 2019, subsequent authorized troubles.

The cybersecurity firm’s starting position for the investigation was a YouTube online video that was posted in November 2018 detailing its attributes, foremost to the discovery of a malware sample (“OriginLogger.exe”) that was uploaded to the VirusTotal malware database on May 17, 2022.

The executable is a builder binary that permits a purchased customer to specify the forms of knowledge to be captured, which includes clipboard, screenshots, and the checklist of applications and products and services (e.g., browsers, email purchasers and so on.) from which the qualifications are to be extracted.

Consumer authentication is attained by sending a request to an OriginLogger server, which resolves to the domain names 0xfd3[.]com and its newer counterpart originpro[.]me dependent on two builder artifacts compiled on September 6, 2020, and June 29, 2022.

Device 42 stated it was equipped to detect a GitHub profile with the username 0xfd3 that hosted two supply code repositories for stealing passwords from Google Chrome and Microsoft Outlook, equally of which are used in OrionLogger.

OrionLogger, like Agent Tesla, is sent by using a decoy Microsoft Phrase document that, when opened, is developed to exhibit an graphic of a passport for a German citizen and a credit score card, together with a number of Excel Worksheets embedded into it.

The worksheets, in switch, contain a VBA macro that uses MSHTA to invoke an HTML webpage hosted on a distant server, which, for its section, consists of an obfuscated JavaScript code to fetch two encoded binaries hosted on Bitbucket.

The first of the two items of malware is a loader that makes use of the system of process hollowing to inject the next executable, the OrionLogger payload, into the aspnet_compiler.exe approach, a genuine utility to precompile ASP.NET applications.

“The malware utilizes tried and true solutions and consists of the means to keylog, steal credentials, just take screenshots, download additional payloads, upload your knowledge in a myriad of ways and endeavor to prevent detection,” White reported.

What’s much more, an evaluation of a corpus of about 1,900 samples demonstrates that the most common exfiltration mechanisms for sending the info back to the attacker is through SMTP, FTP, web uploads to the OrionLogger panel, and Telegram with the help of 181 exclusive bots.

“Industrial keyloggers have traditionally catered to fewer superior attackers, but as illustrated in the initial lure doc analyzed here, this does not make attackers any significantly less able of using a number of tools and products and services to obfuscate and make evaluation far more difficult,” White further more mentioned.

Discovered this post fascinating? Observe THN on Fb, Twitter  and LinkedIn to go through a lot more special information we article.

Some pieces of this short article are sourced from:
thehackernews.com