Friday, July 19, 2024

Agent Tesla’s Successor OriginLogger Keylogger Malware Steals Credentials, Takes Screenshots

The malware called OriginLogger has recently been dissected in detail by security experts from Palo Alto Networks Unit 42. It is believed that OriginLogger is destined to replace Agent Tesla, and this is a widely used info-stealer and RAT.

Tesla is a keylogger and remote access tool that is based on .NET. This malware allows its operators easy access to target systems remotely and sends sensitive data to a C2 controlled by the actor.

It has been available for sale on dark web forums since 2014 and is known to have been used in the wild since then. Malicious spam emails with attachments are generally used to distribute this virus.


The commodity malware (versions 2, 3) was disclosed by cybersecurity firm Sophos in February 2021. These versions featured capabilities to steal credentials from:- 

  • Web browsers
  • Email apps
  • VPN clients
  • Telegram

A claim is being made that version 3 of Agent Tesla is actually OriginLogger, and that is based on some information.

A YouTube video detailing the features of the cybersecurity firm that was posted in November 2018 is the starting point of the cybersecurity firm’s investigation.

Consequently, the VirusTotal malware database was searched for a malware sample that was uploaded on May 17, 2022 entitled OriginLogger.exe and that was in the possession of VirusTotal.

OriginLogger Features

As a builder binary, the executable provides customers with the following features as part of its functionality:-

  • Multi-Language Support
  • 3 Different Delivery: PHP, SMTP, and FTP
  • Keylogger
  • Colored Log
  • Screenshot Logger
  • Multi File Binder
  • Clipboard Logger
  • SmartLogger
  • Password Recovery
  • Web Panel
  • 7/24 Support
  • Fake Message
  • Autobuy
  • Stable and Fast
  • Pure Code
  • All Windows OS Supported
  • UAC Bypass: Win 7/8/10
  • Assembly & Icon Option

As part of the authentication process, a request is sent to the OriginLogger server in order to verify the identity of the user. The following domain names resolve to the following addresses:-

  • 0xfd3[.]com
  • originpro[.]me

As a result of the investigation by Unit 42, a GitHub profile with the username 0xfd3 was identified. During the course of the investigation, it has been detected that two source code repositories were hosted by this profile. While they are used for stealing passwords from the following platforms by exploiting OrionLogger:-

  • Google Chrome
  • Microsoft Outlook

A decoy Microsoft Word document is used to deliver OrionLogger to victims, just as Agent Tesla does. The document contains a number of Excel Worksheets that are embedded into it.

One of which contains an image of a passport of a German citizen, along with one that displays a credit card, and it also contains copies of the passports.

In addition, each of the worksheets contains a VBA macro that calls the HTML page that is hosted on a remote server once the worksheets are loaded.

In many ways, OriginLogger and Agent Tesla are similar keyloggers. OriginLogger, however, is a commoditized keylogger.

As explained in the initial lure document, commercial keyloggers tend to cater to less advanced and sophisticated threat actors. There is a great deal of caution that should be applied to commercial keyloggers in the same manner that one would treat malicious software.

Download SWG – Secure Web Filtering – Free E-book


Latest articles

Hackers Claiming Dettol Data Breach: 453,646 users Impacted

A significant data breach has been reported by a threat actor known as 'Hana,'...

CrowdStrike Update Triggers Widespread Windows BSOD Crashes

A recent update from cybersecurity firm CrowdStrike has caused significant disruptions for Windows users,...

Operation Spincaster Disrupts Approval Phishing Technique that Drains Victim’s Wallets

Chainalysis has launched Operation Spincaster, an initiative to disrupt approval phishing scams that have...

Octo Tempest Know for Attacking VMWare ESXi Servers Added RansomHub & Qilin to Its Arsenal

Threat actors often attack VMware ESXi servers since they accommodate many virtual machines, which...

TAG-100 Actors Using Open-Source Tools To Attack Gov & Private Orgs

Hackers exploit open-source tools to execute attacks because they are readily available, well-documented, and...

macOS Users Beware Of Weaponized Meeting App From North Korean Hackers

Meeting apps are often targeted and turned into weapons by hackers as they are...

Hackers Exploiting Legitimate RMM Tools With BugSleep Malware

Since October 2023, MuddyWater, which is an Iranian threat group linked to MOIS, has...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles