OriginLogger is a variant of the Agent Tesla keylogger and represents its successor with new configuration handling and deployment methods. The analysis covers its builder, string obfuscation, dropper workflow, and multi-channel exfiltration infrastructure, tying OriginLogger to related artifacts and malicious infrastructure.
Keypoints
- OriginLogger is presented as a successor to Agent Tesla, sharing core functionality and detections with Agent Tesla.
- The builder stores configuration data in a concatenated blob that is decoded at runtime using a byte-level XOR (170) and a dedicated GetString function.
- A Real-world dropper uses a Word document with embedded Excel macros (Excel VBA macro) to trigger a download via MSHTA, leading to OriginLogger deployment.
- The dropper workflow includes a Bitbucket snippet containing obfuscated PowerShell code and two binaries; a C# reflective loader (RunPE) hollowing a process injects the OriginLogger payload.
- OriginLogger exfiltration relies on SMTP, FTP, web uploads, and Telegram bots—these channels account for the majority of observed samples and traffic patterns.
- Infrastructural artifacts include originpro.me, originlogger.com, originproducts.xyz, origindproducts.pw, and multiple IPs; URLScan.io and GitHub user 0xfd3 are linked to OriginLogger activity.
- A notable finding is a profile.origin file containing embedded credentials, where flipping values reveals plaintext passwords, illustrating credential exposure within the builder’s artifacts.
MITRE Techniques
- [T1056.001] Keylogging – “Powerful keyboard hook (detects all keybaord strokes…)”
- [T1113] Screen Capture – “Screenshot Logger (time)” and related logs indicate automated screenshot collection
- [T1059.005] Visual Basic – Excel VBA macro used in the dropper to initiate the payload
- [T1218.005] Mshta – MSHTA is used to execute the downloaded script
- [T1055] Process Injection – “a C# reflective loader using CSharp-RunPE… hollow out a process and inject another executable”
- [T1105] Ingress Tool Transfer – “downloads the next payload from a BitBucket snippet” and subsequent payloads
- [T1021.001] Remote Services – RDP login screens on infrastructure servers imply use of remote services
- [T1027] Obfuscated/Encrypted Files and Information – “embedded obfuscated script” and decoding blob logic
Indicators of Compromise
- [IP Address] OriginLogger infrastructure – 23.106.223.46, 23.106.223.47
- [Domain] Origin infrastructure domains – originpro[.]me, originlogger[.]com
- [Domain] Related domains – originproducts[.]xyz, origindproducts[.]pw, mail[.]originlogger[.]com
- [URL] Dropper and payload URLs – http://www.asianexportglass[.]shop/p/25.html, bitbucket[.]org/!api/2.0/snippets/12sds/pEEggp/8cb4e7aef7a46445b9885381da074c86ad0d01d6/files/snippet.txt
- [File Hash] Associated file samples – 595a7ea981a3948c4f387a5a6af54a70a41dd604685c72cbd2a55880c2b702ed, b22a0dd33d957f6da3f1cd9687b9b00d0ff2bdf02d28356c1462f3dbfb8708dd
- [File Name] OriginLogger.exe, profile.origin, settings.ini
Read more: https://unit42.paloaltonetworks.com/originlogger/