Overview

overview

10

Static

static

3

bc91aa3c8e...18.exe

windows7-x64

10

bc91aa3c8e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bc91aa3c8ed724f8105cfc013612af48_JaffaCakes118

  • Size

    335KB

  • Sample

    240618-sew9qaydqh

  • MD5

    bc91aa3c8ed724f8105cfc013612af48

  • SHA1

    1201fe748492c00ad9768bc8f5d7a36e88ad8c87

  • SHA256

    e461ed0705f18460ffb971f686f965749802f0812edc940fe9846217f7d7ef85

  • SHA512

    2d9d6dbd8a6d29318674d21e17ddb4747ef3fef1e19cadc676d8d257b6a116749f6f93c44a7b2c80f5343e19ed343055155bf9f62397cc9c7b47a7b8b56249dc

  • SSDEEP

    6144:2pgl0NRLFx9+HJ/Z6pkTBPKn6BR9h8JMlj9/5evt2/wEUaEWJi4Jtyhq4+hRz:sgl4Lle6pc6W8JMlN5evw/B/EWRgCz

Score
10/10
gcleanerloaderpersistence

Malware Config

Targets

    • Target

      bc91aa3c8ed724f8105cfc013612af48_JaffaCakes118

    • Size

      335KB

    • MD5

      bc91aa3c8ed724f8105cfc013612af48

    • SHA1

      1201fe748492c00ad9768bc8f5d7a36e88ad8c87

    • SHA256

      e461ed0705f18460ffb971f686f965749802f0812edc940fe9846217f7d7ef85

    • SHA512

      2d9d6dbd8a6d29318674d21e17ddb4747ef3fef1e19cadc676d8d257b6a116749f6f93c44a7b2c80f5343e19ed343055155bf9f62397cc9c7b47a7b8b56249dc

    • SSDEEP

      6144:2pgl0NRLFx9+HJ/Z6pkTBPKn6BR9h8JMlj9/5evt2/wEUaEWJi4Jtyhq4+hRz:sgl4Lle6pc6W8JMlN5evw/B/EWRgCz

    Score
    10/10
    gcleanerloaderpersistence

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks