gcleaner

General

Target

6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.zip
Size

4.2MB
Sample

240402-l8kz8aeh38
MD5

0e7504a2b76c4fa51fe7433d4f718ef1
SHA1

2ceb624d79db8b71a13cd5afa16aa552861d7744
SHA256

6f02b53b8924c574597c7a4000eaacec2115514d863cd4bb2d83dd8ca4d80afa
SHA512

98b92962ae85992244553f1a3292cba8bf4e19cdc461916a84482fcb08025b9db1ea5cae55c9602c88debfbe62d45ec281d5effc66d9bd70f5a649cbacd6715b
SSDEEP

98304:61FZuTAX7edlSlC9AJUFeyVVOUlvbfXvSdy1vIFOTJgvRB5NEse:W0dlgtUbOoLf0FOTKvHEX

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90

5.42.65.64

Attributes

url_path
/advdlc.php

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://nidoe.org/tmp/index.php

http://sodez.ru/tmp/index.php

http://uama.com.ua/tmp/index.php

http://talesofpirates.net/tmp/index.php

rc4.i32

Extracted

Family

vidar

C2

https://steamcommunity.com/profiles/76561199658817715

https://t.me/sa9ok

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

5.42.65.0:29587

Extracted

Family

stealc

C2

http://185.172.128.26

Attributes

url_path
/f993692117a3fda2.php

Targets

- Target
  
  6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe
- Size
  
  4.5MB
- MD5
  
  20ed8b8eb556fa3cbc88b83882a6f1b0
- SHA1
  
  cd7ce6fc0068b6ef9c37d5dafec1319a39b88709
- SHA256
  
  6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421
- SHA512
  
  868b859bdff27e41f63b527590214ad22dcaf332bb3d5c7daafd295ea648d71d5bd6d01fee29587eee8b7d4ef01384089eb0b2408f3d2e048021701c357e3b9b
- SSDEEP
  
  98304:in1GhDYSAEbWAtdt7Eea0+JJHOBMT6yCltq5CFvxWof8e45D4UO38cYd5:0gYfux7EF0CHqI6Xg5CFvxW2Pe
Score

10^/10

gcleaner risepro smokeloader pub3 backdoor loader spyware stealer themida trojan glupteba redline stealc vidar zgrat logsdiller cloud (tg: @logsdillabot)dropper evasion infostealer persistence rat vmprotect
- Detect Vidar Stealer
  stealer
- Detect ZGRat V1
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2