Wednesday, November 6, 2024
HomeCyber Security NewsAgent Tesla’s Successor OriginLogger Keylogger Malware Steals Credentials, Takes Screenshots

Agent Tesla’s Successor OriginLogger Keylogger Malware Steals Credentials, Takes Screenshots

Published on

Malware protection

The malware called OriginLogger has recently been dissected in detail by security experts from Palo Alto Networks Unit 42. It is believed that OriginLogger is destined to replace Agent Tesla, and this is a widely used info-stealer and RAT.

Tesla is a keylogger and remote access tool that is based on .NET. This malware allows its operators easy access to target systems remotely and sends sensitive data to a C2 controlled by the actor.

It has been available for sale on dark web forums since 2014 and is known to have been used in the wild since then. Malicious spam emails with attachments are generally used to distribute this virus.

- Advertisement - SIEM as a Service

OriginLogger

The commodity malware (versions 2, 3) was disclosed by cybersecurity firm Sophos in February 2021. These versions featured capabilities to steal credentials from:- 

  • Web browsers
  • Email apps
  • VPN clients
  • Telegram

A claim is being made that version 3 of Agent Tesla is actually OriginLogger, and that is based on some information.

A YouTube video detailing the features of the cybersecurity firm that was posted in November 2018 is the starting point of the cybersecurity firm’s investigation.

Consequently, the VirusTotal malware database was searched for a malware sample that was uploaded on May 17, 2022 entitled OriginLogger.exe and that was in the possession of VirusTotal.

OriginLogger Features

As a builder binary, the executable provides customers with the following features as part of its functionality:-

  • Multi-Language Support
  • 3 Different Delivery: PHP, SMTP, and FTP
  • Keylogger
  • Colored Log
  • Screenshot Logger
  • Multi File Binder
  • Clipboard Logger
  • SmartLogger
  • Password Recovery
  • Web Panel
  • 7/24 Support
  • Fake Message
  • Autobuy
  • Stable and Fast
  • Pure Code
  • All Windows OS Supported
  • UAC Bypass: Win 7/8/10
  • Assembly & Icon Option

As part of the authentication process, a request is sent to the OriginLogger server in order to verify the identity of the user. The following domain names resolve to the following addresses:-

  • 0xfd3[.]com
  • originpro[.]me

As a result of the investigation by Unit 42, a GitHub profile with the username 0xfd3 was identified. During the course of the investigation, it has been detected that two source code repositories were hosted by this profile. While they are used for stealing passwords from the following platforms by exploiting OrionLogger:-

  • Google Chrome
  • Microsoft Outlook

A decoy Microsoft Word document is used to deliver OrionLogger to victims, just as Agent Tesla does. The document contains a number of Excel Worksheets that are embedded into it.

One of which contains an image of a passport of a German citizen, along with one that displays a credit card, and it also contains copies of the passports.

In addition, each of the worksheets contains a VBA macro that calls the HTML page that is hosted on a remote server once the worksheets are loaded.

In many ways, OriginLogger and Agent Tesla are similar keyloggers. OriginLogger, however, is a commoditized keylogger.

As explained in the initial lure document, commercial keyloggers tend to cater to less advanced and sophisticated threat actors. There is a great deal of caution that should be applied to commercial keyloggers in the same manner that one would treat malicious software.

Download SWG – Secure Web Filtering – Free E-book

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Azure API Management Vulnerabilities Let Attackers Escalate Privileges

Recent discoveries by Binary Security have revealed critical vulnerabilities in Azure API Management (APIM) that could...

Google Patches High-Severity Vulnerabilities in Chrome

Google has released a new update for its Chrome browser, addressing two high-severity vulnerabilities....

ClickFix Exploits GMeet & Zoom Pages to Deliver Sophisticated Malware

A new tactic, "ClickFix," has emerged. It exploits fake Google Meet and Zoom pages...

APT36 Hackers Attacking Windows Deevices With ElizaRAT

APT36, a sophisticated threat actor, has been actively targeting Indian entities with advanced malware...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Azure API Management Vulnerabilities Let Attackers Escalate Privileges

Recent discoveries by Binary Security have revealed critical vulnerabilities in Azure API Management (APIM) that could...

Google Patches High-Severity Vulnerabilities in Chrome

Google has released a new update for its Chrome browser, addressing two high-severity vulnerabilities....

ClickFix Exploits GMeet & Zoom Pages to Deliver Sophisticated Malware

A new tactic, "ClickFix," has emerged. It exploits fake Google Meet and Zoom pages...