⚠️ Overview

OriginLogger is a .NET-based information-stealing malware first publicly documented in April 2022 by the AhnLab Security Emergency Response Center (ASEC). It is categorized as a stealer, targeting credentials, cryptocurrency wallets, and browser data. The malware is believed to be operated by a financially motivated threat actor, with initial distribution via spear-phishing emails containing malicious attachments.

🔧 Technical Capabilities

OriginLogger exfiltrates saved credentials and autofill data from Chromium-based browsers, including Google Chrome, Microsoft Edge, and Brave. It also targets FTP clients (FileZilla), email clients (Thunderbird), and cryptocurrency wallet extensions such as MetaMask, Exodus, and Electrum. The malware collects system information, including operating system version, username, hardware identifiers, and installed antivirus software. Exfiltration is performed over HTTP POST requests to a hardcoded command-and-control (C2) server, using the Telegram Bot API as an alternative communication channel. Persistence is achieved by adding a registry run key under HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include delay execution using Thread.Sleep and checking for sandbox environments by detecting common analysis tools like Wireshark or Process Explorer.

📜 History & Notable Incidents

First identified in April 2022, OriginLogger was linked to a campaign distributing the malware via malicious ZIP archives attached to emails impersonating South Korean company invoices. In June 2023, a variant was reported by Cisco Talos that added support for the Selenium Grid remote access protocol to launch automated browser attacks. No CVEs are directly associated with OriginLogger itself; it exploits user behavior rather than software vulnerabilities. No law enforcement actions have been publicly documented as of 2025.

🔍 Detection Indicators

Known SHA-256 hashes include c8f3a7b2e1d9c4f6a5b0d2e3f1c8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f (from ASEC report). Behavioral indicators include the creation of files in %TEMP% with names like logger.exe or BrowserData.exe. Network indicators include outbound HTTP requests to domains ending in .shop or .xyz with user-agent strings containing Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (fake Chrome). Registry keys created under HKCU...Run with value OriginLogger are a definitive signature.

☠️ Risk & Impact

The primary impact is theft of sensitive credentials, leading to account takeovers and potential financial loss from drained cryptocurrency wallets. The malware targets individuals and small-to-medium businesses, particularly in South Korea and other East Asian regions. There is no evidence of ransomware functionality, making OriginLogger a pure data exfiltration threat with residual risk of credential reuse across enterprise services.

🛡️ Mitigation

Organizations should enable multi-factor authentication (MFA) for all accounts and deploy endpoint detection and response (EDR) solutions that monitor for registry persistence creation and suspicious outbound HTTP POSTs. Blocking Telegram API endpoints at the network perimeter and disabling macros in email attachments can reduce infection risk.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.