gcleaner

General

Target

6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.zip
Size

4.2MB
Sample

240402-qwjc3sbf9w
MD5

f70f2c0e36242deac924fab257074752
SHA1

ec185dacc57e446f906a8992b744aa0f183331e6
SHA256

196d5b9c15745bc755fea17a32d6cbc9fc5221374966aca086872e8df44fe0e4
SHA512

cd1d630f730b86f1074a423f883de28e32b03f15fbec1afbe7e854e3e1e6ce462b8b1a76c035ef5781351bd3945a6011167036e168d3d00690970d57c473d08c
SSDEEP

98304:P7z60/8oInFe57uBUHhTcOZhoVHodELGde5rr8tL3ZdbIknr+OBQ:PLoUSUH9Zhbfk5rrO1dbBBBQ

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://nidoe.org/tmp/index.php

http://sodez.ru/tmp/index.php

http://uama.com.ua/tmp/index.php

http://talesofpirates.net/tmp/index.php

rc4.i32

Extracted

Family

gcleaner

C2

185.172.128.90

5.42.65.64

Attributes

url_path
/advdlc.php

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

stealc

C2

http://185.172.128.26

Attributes

url_path
/f993692117a3fda2.php

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

5.42.65.0:29587

Extracted

Family

vidar

C2

https://steamcommunity.com/profiles/76561199658817715

https://t.me/sa9ok

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36

Targets

- Target
  
  6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe
- Size
  
  4.5MB
- MD5
  
  20ed8b8eb556fa3cbc88b83882a6f1b0
- SHA1
  
  cd7ce6fc0068b6ef9c37d5dafec1319a39b88709
- SHA256
  
  6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421
- SHA512
  
  868b859bdff27e41f63b527590214ad22dcaf332bb3d5c7daafd295ea648d71d5bd6d01fee29587eee8b7d4ef01384089eb0b2408f3d2e048021701c357e3b9b
- SSDEEP
  
  98304:in1GhDYSAEbWAtdt7Eea0+JJHOBMT6yCltq5CFvxWof8e45D4UO38cYd5:0gYfux7EF0CHqI6Xg5CFvxW2Pe
Score

10^/10

gcleaner glupteba risepro smokeloader stealc pub3 backdoor dropper loader spyware stealer themida trojan redline vidar zgrat logsdiller cloud (tg: @logsdillabot)evasion infostealer persistence rat vmprotect
- Detect Vidar Stealer
  stealer
- Detect ZGRat V1
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2