Overview

overview

10

Static

static

3

ed47c5f388...18.exe

windows7-x64

10

ed47c5f388...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed47c5f388f563faacd84f0b0cf1e4dd_JaffaCakes118

  • Size

    268KB

  • Sample

    240411-m82hmsdc9y

  • MD5

    ed47c5f388f563faacd84f0b0cf1e4dd

  • SHA1

    2cb750313a8bdc6c191ae22b3abbd7b8a8eed928

  • SHA256

    356f35a3ef07bd1c5764759fa7406e598d22c70fd758354a21a1366afa6e3e95

  • SHA512

    a7a8f6fff6ac29729825e65824e408052f13aa46ff35fddf1904e7c4a0f9a0fc27393f217523e7e1bb08ac22f189925934c6ed884bbddc8fcc8e412e90958465

  • SSDEEP

    3072:qxdUNZQM801ejOMaFguLKKw/NUK6fQ7nYKvdkHcwBHSXrmI7HuzyYuB5NRcUsI5G:5ZX1ejOTtO/NNic8HOju2bhsI5/

Score
10/10
gcleaneronlyloggervidarloaderstealer

Malware Config

Extracted

Family

gcleaner

C2

194.145.227.161

Targets

    • Target

      ed47c5f388f563faacd84f0b0cf1e4dd_JaffaCakes118

    • Size

      268KB

    • MD5

      ed47c5f388f563faacd84f0b0cf1e4dd

    • SHA1

      2cb750313a8bdc6c191ae22b3abbd7b8a8eed928

    • SHA256

      356f35a3ef07bd1c5764759fa7406e598d22c70fd758354a21a1366afa6e3e95

    • SHA512

      a7a8f6fff6ac29729825e65824e408052f13aa46ff35fddf1904e7c4a0f9a0fc27393f217523e7e1bb08ac22f189925934c6ed884bbddc8fcc8e412e90958465

    • SSDEEP

      3072:qxdUNZQM801ejOMaFguLKKw/NUK6fQ7nYKvdkHcwBHSXrmI7HuzyYuB5NRcUsI5G:5ZX1ejOTtO/NNic8HOju2bhsI5/

    Score
    10/10
    gcleaneronlyloggervidarloaderstealer

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • OnlyLogger

      A tiny loader that uses IPLogger to get its payload.

      loaderonlylogger

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • OnlyLogger payload

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks