First time seeing #expiro drop #originlogger:

https://app.any.run/tasks/3d2d1d8b-b635-40b3-8a45-5edcaf3872b0/

#xworm dropping #originlogger , and reusing #remcos c2:

https://app.any.run/tasks/9e32da84-ba55-4ac9-96f2-b7ff02d15d6b

#originlogger #malware at:

https://github\.com/jaybobo1/Supplier

c2: mail.dndmelectrical\.co\.za

2024-11-25 (Monday): I love it when criminals email malware directly to my inbox. This one is #AgentTesla (or #OriginLogger or whatever it's called now) using FTP for data exfiltration.

It sends harvested login credentials, browser cookies and keylogger data to an FTP server at ftp.ercolina-usa[.]com approx every 10 minutes.

As noted in one of the images, two-letter indicators in the file names indicate the type of exfiltrated data:

PW = login credentials harvested from the infected windows host (passwords)

CO = cookies and other data from web browsers on the infected host

KL = Keylogger data from any collected keystrokes on the infected host.

Attached disk image file: https://bazaar.abuse.ch/sample/7a11d2d4ea5b0bf486c6e6695ff919e58aa54babb77061f4bbfe476ce1ec1738

Extracted AgentTesla EXE: https://bazaar.abuse.ch/sample/2362b4a5329f506af677d1e4cac2b92da252afdf4842bf4e8796b43c4ccb6714

Today's #malware from 4/12/2024

scan document_doccx.exe.bz2 (#application/x-bzip2, 647.76 kB)
#MD5:
89661fcdb21d7bdcbcf7d88b57589e57
#sha1:
0ab99af2d598137f985b7e0a5448b9bcd9c2e46c
#SHA256:
26e80ec8126b8cf5b13a94e8a0fbea348f8bcc3cd4caab27628921cb908c4a48
#SHA512:
cdd07b56a71fb6d7fa0b175a6a60f6d7d03e53394038027e881cbddd77d8a36291ac4511905ac4d45d3fd4c8d55878a1f0e324e927c92848b05f4e9ce1f29702

https://www.filescan.io/uploads/661d66f454bafb7d21cd5ae6/reports/aa1cc1a8-41e3-468e-a87e-f0dd410217f3/overview
https://www.virustotal.com/gui/file/26e80ec8126b8cf5b13a94e8a0fbea348f8bcc3cd4caab27628921cb908c4a48

#spammers #phishing #malicious #maliciousexe

#originlogger #commontrash #common #infostealer

More #hagga via booking . com #malspam pdf -> js -> #originlogger

https://app.any.run/tasks/6e0e4947-fd2e-4d97-855a-a3b4cc9d819b

Some fresh #hagga -> #originlogger via booking . com:

https://app.any.run/tasks/d7fe276d-82e2-421c-92c5-8b0e4a9a65e5

Quite possibly the oddest #originlogger sample I've seen:

https://app.any.run/tasks/58764c9c-d6aa-4acf-9fb0-d5d4c803b925