gcleaner

General

Target

7502f3e13fd9416229f24c7f956bc21f
Size

269KB
Sample

240125-vcq12abhcj
MD5

7502f3e13fd9416229f24c7f956bc21f
SHA1

fdc74c687a8e14624bcfbab3c81441d3364e88c3
SHA256

5b7c58fb0a1cee2111ee220dd1273f467de8ca5dddff3e4a8d992a98557bb20e
SHA512

4184acdae40f5e32533e0666a5f6813a2e8daef141862f6fbd4b63a66dbec7e439fa091a70a1ea5da36c7b1702ac6f728b726b78d9bdf9f9d1602247e932e245
SSDEEP

3072:NyFcpGHBJutqtZri91tkVcWNgvbiQQseHFd+xGLJ+v8rRRUh54F9UmgM:N+XutqDr61tTWmuQCYSrFtb

Score

10^/10

Malware Config

Extracted

Family

gcleaner

C2

194.145.227.161

Targets

- Target
  
  7502f3e13fd9416229f24c7f956bc21f
- Size
  
  269KB
- MD5
  
  7502f3e13fd9416229f24c7f956bc21f
- SHA1
  
  fdc74c687a8e14624bcfbab3c81441d3364e88c3
- SHA256
  
  5b7c58fb0a1cee2111ee220dd1273f467de8ca5dddff3e4a8d992a98557bb20e
- SHA512
  
  4184acdae40f5e32533e0666a5f6813a2e8daef141862f6fbd4b63a66dbec7e439fa091a70a1ea5da36c7b1702ac6f728b726b78d9bdf9f9d1602247e932e245
- SSDEEP
  
  3072:NyFcpGHBJutqtZri91tkVcWNgvbiQQseHFd+xGLJ+v8rRRUh54F9UmgM:N+XutqDr61tTWmuQCYSrFtb
Score

10^/10

gcleaner onlylogger vidar loader stealer kinsing
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Kinsing
  Kinsing is a loader written in Golang.
  loader kinsing
- OnlyLogger
  A tiny loader that uses IPLogger to get its payload.
  loader onlylogger
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- OnlyLogger payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Kinsing

OnlyLogger

Vidar

OnlyLogger payload

Checks computer location settings

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2