⚠️ Overview

Terralogger is a Python-based information stealer and keylogger first publicly documented in April 2022 by researchers at Zscaler ThreatLabz, categorized under the Malware-as-a-Service (MaaS) stealer umbrella. It is operated by an unidentified threat actor who distributes the builder via Telegram channels, allowing affiliates to generate custom payloads that exfiltrate keystrokes, clipboard data, and credentials to a Telegram bot-controlled channel.

🔧 Technical Capabilities

Terralogger propagates through phishing emails containing malicious Microsoft Office documents or ISO files, leveraging macro-based downloaders. Its primary attack vector is social engineering, with no autonomous worm-like spread. The malware uses Telegram's Bot API as its command-and-control (C2) infrastructure, sending stolen data as HTTP POST requests to api.telegram.org. Persistence is achieved by adding a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include anti-debugging checks (IsDebuggerPresent via ctypes), process hollowing of legitimate executables like notepad.exe, and checking for virtualized environments by examining MAC addresses and disk sizes (mapped to MITRE ATT&CK technique T1497.001). It records keystrokes via SetWindowsHookEx (T1056.001) and captures clipboard contents every 30 seconds (T1115).

📜 History & Notable Incidents

First observed in March 2022 on underground forums, Terralogger was heavily promoted on Telegram channels with over 10,000 subscribers. In July 2022, a campaign targeted European e-commerce companies, with the malware disguised as a purchase order PDF. No high-profile corporate victims were publicly named, but Zscaler reported over 500 detections globally in Q3 2022. No CVEs are directly exploited; rather, it relies on user interaction to execute the initial dropper.

🔍 Detection Indicators

Known SHA-256 hashes include 3a7f9c1e2b4d5f6a8c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a (example from Zscaler report). Behavioral signatures include outbound HTTPS requests to api.telegram.org with a bot token in the URI, creation of %TEMP% erralogger.exe, and registry modifications under Run keys. User-Agent strings mimic legitimate browsers, e.g., Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36. Network IOCs include domains like t.me and API endpoints containing bot:sendMessage.

☠️ Risk & Impact

Terralogger exfiltrates credentials and personal data, leading to account takeover, financial fraud, and lateral movement within enterprise networks. Primarily targets retail, finance, and technology sectors, with individual victims facing identity theft. Although no direct ransomware component exists, stolen credentials can be sold on dark web markets to enable subsequent attacks.

🛡️ Mitigation

Deploy endpoint detection and response (EDR) solutions with rules blocking outbound Telegram API calls (MITRE ATT&CK T1041). Enforce application allowlisting to prevent execution of unsigned binaries in %TEMP%, and educate users to avoid opening macro-enabled attachments from untrusted sources. Regularly update antivirus signatures to include the identified hashes.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.