Analysis
-
max time kernel
163s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 05:37
Static task
static1
Behavioral task
behavioral1
Sample
2a4a2a81d7b64912b929d4ecfa94e2a6.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2a4a2a81d7b64912b929d4ecfa94e2a6.exe
Resource
win10v2004-20231215-en
General
-
Target
2a4a2a81d7b64912b929d4ecfa94e2a6.exe
-
Size
266KB
-
MD5
2a4a2a81d7b64912b929d4ecfa94e2a6
-
SHA1
842428d47d16ef1f8ade0c48441c35e6bae112a1
-
SHA256
43a30f28b31265a8bfcb084c9095a84139c3fac46f3f2ea55fcb78880609fbca
-
SHA512
1b362325e510abe111509cd87dbe9811c20f3e84f3b95cd9666945523b96adf86af9659fccf65d85150f13dc9eae5fab1aac08554bb130a97930d054c312b1a4
-
SSDEEP
3072:88svNt2s/gTH77qA0lHGo5kQVJ25OdMv8G1xbeRfRVIBN4URuQQuKT0yB3m4nY:Kt2NTb+A0lvxVI5OdnG3bzW3l+4
Malware Config
Extracted
gcleaner
194.145.227.161
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger payload 4 IoCs
resource yara_rule behavioral2/memory/1760-2-0x00000000048E0000-0x000000000490F000-memory.dmp family_onlylogger behavioral2/memory/1760-3-0x0000000000400000-0x0000000002CD1000-memory.dmp family_onlylogger behavioral2/memory/1760-4-0x0000000000400000-0x0000000002CD1000-memory.dmp family_onlylogger behavioral2/memory/1760-7-0x00000000048E0000-0x000000000490F000-memory.dmp family_onlylogger