⚠️ Overview

Unknown Logger is a lightweight .NET‑based keylogger first documented in a June 2022 report by cybersecurity vendor Sekoia, attributed to an unaffiliated threat actor tracked as TA‑UNK‑L. It falls under the Information Stealer category, primarily designed to capture keystrokes, clipboard data, and screen contents from compromised Windows systems.

🔧 Technical Capabilities

Unknown Logger uses a simple yet effective hooking mechanism (SetWindowsHookEx) to intercept keystrokes at the system level, logging all input into a local file under %TEMP%log.tmp. It establishes command‑and‑control (C2) over HTTPS using a hardcoded IP address or domain, exfiltrating captured data via HTTP POST requests with a unique User‑Agent string Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36. Persistence is achieved through a registry Run key at HKCUSoftwareMicrosoftWindowsCurrentVersionRunULogger. Evasion techniques include obfuscation of the .NET assembly using ConfuserEx, delayed execution of 30 seconds after startup, and checking for sandbox processes like vboxservice.exe to avoid analysis environments.

📜 History & Notable Incidents

Unknown Logger first appeared in mid‑2021, initially distributed through phishing emails with weaponized Office documents containing VBA macros that download the payload from a Pastebin‑like service. No high‑profile victims are publicly known, but Sekoia observed a targeted campaign against Middle Eastern energy sector employees. No CVEs are directly associated with the malware; its delivery relies on known phishing techniques rather than exploits.

🔍 Detection Indicators

Behavioral signatures include the creation of a mutex named GlobalUL_MTX and a scheduled task named ULoggerUpdate for re‑establishing persistence. Network IOCs consist of the C2 domain update‑logger[.]com (since taken down) and the IP 185.234.72[.]99. Registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunULogger is a strong indicator. No public file hashes are available as the malware is frequently re‑packed.

☠️ Risk & Impact

Compromised credentials obtained via keystroke logging can lead to lateral movement and full system takeover, particularly dangerous for organizations in the energy and finance sectors. Although Unknown Logger does not encrypt files, the exfiltration of sensitive communications and passwords facilitates secondary ransomware attacks. Financial losses are difficult to quantify but are estimated in the tens of thousands per incident based on incident response costs.

🛡️ Mitigation

Defenders should enforce application whitelisting to block unsigned .NET executables, deploy EDR rules to detect keylogging API calls (e.g., SetWindowsHookEx), and block outbound connections to the known C2 indicators. Regular phishing awareness training reduces initial infection risk. For MITRE ATT&CK mapping, see techniques T1056.001 (Input Capture) and T1547.001 (Registry Run Keys / Startup Folder).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.