Overview

overview

10

Static

static

3

9948f0a4cb...18.exe

windows7-x64

10

9948f0a4cb...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9948f0a4cbda060203118bac76a7d57d_JaffaCakes118

  • Size

    378KB

  • Sample

    240605-z7ry2ahf7t

  • MD5

    9948f0a4cbda060203118bac76a7d57d

  • SHA1

    54ab234810c4acf4dbef61d42d7e65b141290910

  • SHA256

    57d1724758713e07ca5a52847e3ba07090f2b814d7528c9e0bfc952c460b0f9a

  • SHA512

    7222a9f65fb41aa9b7b2c198d668222399d43c5c21ddc50d01ae56b507da8cfa2b29a82af05c43554821ad86e40c083c587c98b9008cef701bea92df8d12a0d4

  • SSDEEP

    6144:ImrfwmHouuIzknonHKDl1qzoN7xpPlQgeZl3gObVfeZejOFjTS91PDAf:ImrfZHouugKDgoNNpdfsl3gOIpjTeDAf

Score
10/10
gcleanerloader

Malware Config

Targets

    • Target

      9948f0a4cbda060203118bac76a7d57d_JaffaCakes118

    • Size

      378KB

    • MD5

      9948f0a4cbda060203118bac76a7d57d

    • SHA1

      54ab234810c4acf4dbef61d42d7e65b141290910

    • SHA256

      57d1724758713e07ca5a52847e3ba07090f2b814d7528c9e0bfc952c460b0f9a

    • SHA512

      7222a9f65fb41aa9b7b2c198d668222399d43c5c21ddc50d01ae56b507da8cfa2b29a82af05c43554821ad86e40c083c587c98b9008cef701bea92df8d12a0d4

    • SSDEEP

      6144:ImrfwmHouuIzknonHKDl1qzoN7xpPlQgeZl3gObVfeZejOFjTS91PDAf:ImrfZHouugKDgoNNpdfsl3gOIpjTeDAf

    Score
    10/10
    gcleanerloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks