Overview

overview

10

Static

static

3

2292066741...18.exe

windows7-x64

10

2292066741...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    229206674159b840bbf5aa6ad232f238_JaffaCakes118

  • Size

    450KB

  • Sample

    241008-t6t44svhjm

  • MD5

    229206674159b840bbf5aa6ad232f238

  • SHA1

    91a0e5acc4ca3078be2ec9e5bbd539fae16ca35b

  • SHA256

    32b870cd93337815674a72fc3d334ef4a88c05f93002bd5bf70aaaa586c80f52

  • SHA512

    3910fbd13fcd12629524b99277b3dba9740a3906ccc167561967ea3dd8a7b2c8d25da6cc96965e6456beb7edc9743217a1fef8433577b73adbb15a451706ad2a

  • SSDEEP

    6144:fsDtWbyJoK1nWbCbcRtmDzyn3Qo6k7UtPclWUHI8tYV:ktWbaoAntcvQnLPw7HO

Score
10/10
gcleanerdiscoveryloader

Malware Config

Targets

    • Target

      229206674159b840bbf5aa6ad232f238_JaffaCakes118

    • Size

      450KB

    • MD5

      229206674159b840bbf5aa6ad232f238

    • SHA1

      91a0e5acc4ca3078be2ec9e5bbd539fae16ca35b

    • SHA256

      32b870cd93337815674a72fc3d334ef4a88c05f93002bd5bf70aaaa586c80f52

    • SHA512

      3910fbd13fcd12629524b99277b3dba9740a3906ccc167561967ea3dd8a7b2c8d25da6cc96965e6456beb7edc9743217a1fef8433577b73adbb15a451706ad2a

    • SSDEEP

      6144:fsDtWbyJoK1nWbCbcRtmDzyn3Qo6k7UtPclWUHI8tYV:ktWbaoAntcvQnLPw7HO

    Score
    10/10
    gcleanerdiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks