gcleaner

General

Target

ca48a01552acf9cb77202bf0b77a7a1c_JaffaCakes118
Size

3.4MB
Sample

240405-elfnnabf3v
MD5

ca48a01552acf9cb77202bf0b77a7a1c
SHA1

1daba5dbab15456462e1ac3e80b782aa867889c2
SHA256

106d93ced41d81795f66bb29ad5c847a25a1e2c094fe28a67dc576f1c33fcad4
SHA512

f5942e6a162c2b3e5df3ac14b24350f36e393ddb80400fcd47070e70b6eccaa366ef3406c8452b795c7b28cf2266fd8eb1339f51dcc1910a004c72e14cbe8a55
SSDEEP

49152:Kj4FOCYYcrX7JGwyTL2RhE3IiSKVFGclOt45MaUEr7NSv2opoSH7QirAnN4tSqJS:cRCHCowyTL2RgSWj5WaU28wN4t0N

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

41.4

Botnet

933

C2

https://mas.to/@sslam

Attributes

profile_id
933

Extracted

Family

gcleaner

C2

ppp-gl.biz

45.9.20.13

Extracted

Family

raccoon

Version

1.8.2

Botnet

87d2a2b472952d29d9ef08f8b28a7b6b1e587f6a

Attributes

url4cnc
http://telemirror.top/jredmankun
http://tgmirror.top/jredmankun
http://telegatt.top/jredmankun
http://telegka.top/jredmankun
http://telegin.top/jredmankun
https://t.me/jredmankun

rc4.plain

Targets

- Target
  
  ca48a01552acf9cb77202bf0b77a7a1c_JaffaCakes118
- Size
  
  3.4MB
- MD5
  
  ca48a01552acf9cb77202bf0b77a7a1c
- SHA1
  
  1daba5dbab15456462e1ac3e80b782aa867889c2
- SHA256
  
  106d93ced41d81795f66bb29ad5c847a25a1e2c094fe28a67dc576f1c33fcad4
- SHA512
  
  f5942e6a162c2b3e5df3ac14b24350f36e393ddb80400fcd47070e70b6eccaa366ef3406c8452b795c7b28cf2266fd8eb1339f51dcc1910a004c72e14cbe8a55
- SSDEEP
  
  49152:Kj4FOCYYcrX7JGwyTL2RhE3IiSKVFGclOt45MaUEr7NSv2opoSH7QirAnN4tSqJS:cRCHCowyTL2RgSWj5WaU28wN4t0N
Score

10^/10

gcleaner lgoogloader onlylogger raccoon vidar 87d2a2b472952d29d9ef08f8b28a7b6b1e587f6a 933 downloader loader stealer xmrig miner
- Detects LgoogLoader payload
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- LgoogLoader
  A downloader capable of dropping and executing other malware families.
  downloader lgoogloader
- OnlyLogger
  A tiny loader that uses IPLogger to get its payload.
  loader onlylogger
- Raccoon
  Raccoon is an infostealer written in C++ and first seen in 2019.
  stealer raccoon
- Raccoon Stealer V1 payload
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- OnlyLogger payload
- Vidar Stealer
  stealer
- XMRig Miner payload
  miner
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral1 behavioral2