gcleaner

General

Target

6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.zip
Size

4.2MB
Sample

240402-mp3xcsfd41
MD5

683b62356b07d5b405903ffa2a3afb59
SHA1

6585b4116022dcc7ffcb69f08c9540615ece607e
SHA256

e3f3ad550bc7b03e30074356d23946b0ffd5def8e754159e27e27f4e70ef29cf
SHA512

cd757370c3be71c14c90143df99a70ef11abf7672eebe26324b2d2ee91f4efe791f56ea84af3e25859ab298e406318a82360608edbc277fb4199296eef069ddb
SSDEEP

98304:S68miKvVCYIgsGyCcrIfspjWZSMEsslndiBTQmg7oqse:czKvMYIgsG5cqqWsnsCdiBTU7Ye

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

gcleaner

C2

185.172.128.90

5.42.65.64

Attributes

url_path
/advdlc.php

Extracted

Family

stealc

C2

http://185.172.128.26

Attributes

url_path
/f993692117a3fda2.php

Extracted

Family

vidar

C2

https://steamcommunity.com/profiles/76561199658817715

https://t.me/sa9ok

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

5.42.65.0:29587

Extracted

Family

smokeloader

Version

2022

C2

http://nidoe.org/tmp/index.php

http://sodez.ru/tmp/index.php

http://uama.com.ua/tmp/index.php

http://talesofpirates.net/tmp/index.php

rc4.i32

Targets

- Target
  
  6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe
- Size
  
  4.5MB
- MD5
  
  20ed8b8eb556fa3cbc88b83882a6f1b0
- SHA1
  
  cd7ce6fc0068b6ef9c37d5dafec1319a39b88709
- SHA256
  
  6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421
- SHA512
  
  868b859bdff27e41f63b527590214ad22dcaf332bb3d5c7daafd295ea648d71d5bd6d01fee29587eee8b7d4ef01384089eb0b2408f3d2e048021701c357e3b9b
- SSDEEP
  
  98304:in1GhDYSAEbWAtdt7Eea0+JJHOBMT6yCltq5CFvxWof8e45D4UO38cYd5:0gYfux7EF0CHqI6Xg5CFvxW2Pe
Score

10^/10

gcleaner glupteba risepro smokeloader stealc pub3 backdoor discovery dropper evasion loader persistence spyware stealer themida trojan redline vidar zgrat logsdiller cloud (tg: @logsdillabot)infostealer rat vmprotect
- Detect Vidar Stealer
  stealer
- Detect ZGRat V1
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Stops running service(s)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2