Origin Logger
A closer look at this Agent Tesla successor
Overview
This is a .NET stealer that is possibly a clone or new version of AgentTesla. It has been sold on public grayware sites such as fudsender[.]com.
There is even a YouTube commercial for the stealer!
https://www.youtube.com/watch?v=o-MDujYrtto
Sample
b1114c27beb856eae1f9fba0a880450702b7bda007f0fbacc4d5df561d83ec88 UnpacMe
References
Settings
public static bool Keylogger = true;
public static int LoggerInterval = 10;
public static bool PasswordRecovery = true;
public static bool CookieRecovery = true;
public static int TenantId = 4319;
public static string PcHwid = "";
public static string PcName = "";
public static string AsmLocation = "";
public static int CheckInterval = 5000;
public static string PublicKey = "<RSAKeyValue><Modulus>rAoFBxYpptcD05ezf2if4RlryyqIBxjA3797MhTklk3xemvM9Y+Wle6P5hBHzSu95KQmgea8lzbH7RA3HOb1UvKErFeJ3jT5XhsqaT4AcDLRQraXpmxz+rzW0GK+ZvJFYmIL+18m4j/TAHjT40L0wEcfu2qzrIzroEFupW/oELM=</Modulus><Exponent>AQAB</Exponent></RSAKeyValue>";
public static string PublicUserAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0";
public static bool AppAddStartup = Convert.ToBoolean("false");
public static bool HideFileStartup = Convert.ToBoolean("false");
public static string AppStartupFullPath = "";
public static string StartupDirectoryPath = "";
public static string StartupEnvName = "appdata";
public static string StartupDirectoryName = "hhlquS";
public static string StartupInstallationName = "hhlquS.exe";
public static string StartupRegName = "hhlquS";
public static string DownloadFolderName = "4yyaqgto.m0g";
public static string DownloadDirectoryPath = "";
public static string CurrentUrl = "";
public static string[] FallbackUrls = new string[] { "https://nitrosoftwares.shop/gate" };
Yara Rule
rule OriginLogger {
strings:
$s1 = "select * from Win32_Processor" wide
$s2 = "FileArgs" wide
$s3 = "StringFileInfo" wide
$s4 = "select * from Win32_VideoController" wide
$s5 = "Win32_NetworkAdapterConfiguration" wide
$s6 = "downloadexecute" wide
$x = "x-key" wide nocase
$dl_bytes = {7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 03 04 28 ?? ?? ?? ?? 0A 02 06 28 ?? ?? ?? ?? 06 28 }
condition:
filesize < 50KB and
(
(
5 of ($s*) and
$x
) or
(
$dl_bytes
)
)
}import re
file_data = open('/tmp/origin.bin', 'rb').read()
def filter_printable(data):
out = []
for c in data:
if c < 33 or c > 126 or c == 92:
continue
out.append(c)
return bytes(out)
def get_c2s(file_data):
c2s = []
for s in file_data.split(b'h\x00t\x00t\x00'):
if s[:2] == b'p\x00':
tmp = s.split(b'\x00\x00')[0]
out = b'htt' + filter_printable(tmp.replace(b'\x00',b''))
if len(out) < 4 or len(out) > 50:
continue
#print(out)
c2s.append(out.decode('utf-8'))
return c2s
get_c2s(file_data)
# import required module
import os
# assign directory
directory = '/tmp/samples'
# iterate over files in
# that directory
for filename in os.listdir(directory):
f = os.path.join(directory, filename)
# checking if it is a file
if os.path.isfile(f):
print(f)
file_data = open(f, 'rb').read()
print(get_c2s(file_data))