Overview

overview

10

Static

static

3

f4b6825221...18.exe

windows7-x64

10

f4b6825221...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f4b6825221e1fa2c7e9f3d46917fa11d_JaffaCakes118

  • Size

    363KB

  • Sample

    240417-bd5q2ahc36

  • MD5

    f4b6825221e1fa2c7e9f3d46917fa11d

  • SHA1

    1c0d77931ec4f940c40f70ff0ad94d0562f996de

  • SHA256

    a6e7a65ad515a67a06dcbe2591faaef1b4629632c17fadc999ac1c45a87caa18

  • SHA512

    3faca8a337148c3f7cfc15eaad85e50bf36baf3ecaa715af04392aa555559be0826c9e9dc97f9436a2b846b60a7e4a9fcc0e5ab5eb69a55894e4924926ab8169

  • SSDEEP

    6144:4royc25Q/6MZd+MZZ+07Xg2VM+I5dzmd3u8Ot/Q5xm552yy1tzH:Xb2eSMZVZ+Ac+ILaxuD96s2yot

Score
10/10
gcleaneronlyloggervidarloaderstealer

Malware Config

Extracted

Family

gcleaner

C2

194.145.227.161

Targets

    • Target

      f4b6825221e1fa2c7e9f3d46917fa11d_JaffaCakes118

    • Size

      363KB

    • MD5

      f4b6825221e1fa2c7e9f3d46917fa11d

    • SHA1

      1c0d77931ec4f940c40f70ff0ad94d0562f996de

    • SHA256

      a6e7a65ad515a67a06dcbe2591faaef1b4629632c17fadc999ac1c45a87caa18

    • SHA512

      3faca8a337148c3f7cfc15eaad85e50bf36baf3ecaa715af04392aa555559be0826c9e9dc97f9436a2b846b60a7e4a9fcc0e5ab5eb69a55894e4924926ab8169

    • SSDEEP

      6144:4royc25Q/6MZd+MZZ+07Xg2VM+I5dzmd3u8Ot/Q5xm552yy1tzH:Xb2eSMZVZ+Ac+ILaxuD96s2yot

    Score
    10/10
    gcleaneronlyloggervidarloaderstealer

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • OnlyLogger

      A tiny loader that uses IPLogger to get its payload.

      loaderonlylogger

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • OnlyLogger payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks