Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
29-03-2024 22:03
General
-
Target
2de8d046d57fa60509800b164868a881_JaffaCakes118.exe
-
Size
442KB
-
MD5
2de8d046d57fa60509800b164868a881
-
SHA1
905be498f9490445da60c9ee457de1e8411ce074
-
SHA256
02883fa63667972547fe36023646554c3d2895b41c5a8683ab5b2292f5d2d464
-
SHA512
addb7b321517a94e1c4da2835178063a739ec01fa6d2e23b8221a50b6d6371b298e5f25a4bbc13d7e3990ab6116f50907e8d7409ee123824c6579fe5f6597735
-
SSDEEP
12288:b9i0a/2iNj0gXXj2+ZQo8zbNHrf0PBbGMpv:bG2iNjZXjhQzrf0P3
Score
10/10
Malware Config
Extracted
Family
gcleaner
C2
ppp-gl.biz
45.9.20.13
Signatures
-
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger payload 3 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2de8d046d57fa60509800b164868a881_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2de8d046d57fa60509800b164868a881_JaffaCakes118.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
292KB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
1024KB