Overview

overview

10

Static

static

3

0fff3a2336...18.exe

windows7-x64

10

0fff3a2336...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0fff3a233688f29baba586bed98eb460_JaffaCakes118

  • Size

    362KB

  • Sample

    240328-zxx3ashd34

  • MD5

    0fff3a233688f29baba586bed98eb460

  • SHA1

    c5e498a2374431dc283703a4e6dd998925b52043

  • SHA256

    24947721f59a0ce3e171f32a33182005a857a2a67c78a28f6303a5d56b3fef58

  • SHA512

    bedf9b550407ab16e8c98eee364a550c2983e89801fface509522700ea18139274105ef4d2e8621815d3961d4fdbbeab635473163b924694e12bccc42f2b45bc

  • SSDEEP

    6144:WtlntEqzHQW23MMYL6Fhnw3AxR7DWv+nIG37wLebuIADG8el:WjntEhW23MMHF8uRvXoxD

Score
10/10
gcleaneronlyloggervidarloaderstealer

Malware Config

Extracted

Family

gcleaner

C2

gcl-gb.biz

45.9.20.13

Targets

    • Target

      0fff3a233688f29baba586bed98eb460_JaffaCakes118

    • Size

      362KB

    • MD5

      0fff3a233688f29baba586bed98eb460

    • SHA1

      c5e498a2374431dc283703a4e6dd998925b52043

    • SHA256

      24947721f59a0ce3e171f32a33182005a857a2a67c78a28f6303a5d56b3fef58

    • SHA512

      bedf9b550407ab16e8c98eee364a550c2983e89801fface509522700ea18139274105ef4d2e8621815d3961d4fdbbeab635473163b924694e12bccc42f2b45bc

    • SSDEEP

      6144:WtlntEqzHQW23MMYL6Fhnw3AxR7DWv+nIG37wLebuIADG8el:WjntEhW23MMHF8uRvXoxD

    Score
    10/10
    gcleaneronlyloggervidarloaderstealer

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • OnlyLogger

      A tiny loader that uses IPLogger to get its payload.

      loaderonlylogger

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • OnlyLogger payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks