General

  • Target

    e4be75c471d13df766c869ef78e63698_JaffaCakes118

  • Size

    331KB

  • Sample

    241212-fckrpa1mbt

  • MD5

    e4be75c471d13df766c869ef78e63698

  • SHA1

    96510afbe52c4897b53bf6c9a0a71bd6c4961949

  • SHA256

    9eef2d09ceecb2014ef5fff7ff2fcacbfb7106bcd18bbc1b717d36e898e469d8

  • SHA512

    8280d408e26f282e8686c3199c4b3bb99482abf06e04dc646700e69a2fc3d50f4aeb9dbe7f20239a078eec7749fc920ab12d2b85da50950a97e4405bb2a24491

  • SSDEEP

    3072:lmnOYAZEKVkMRvGzdJW+uB9t+0q1765b20AyrhKD1RHT1I9A2rD0vkjyiOykNScS:lmORZEvm+uPsT76v2D2/rDV2Sc6VRn

Malware Config

Extracted

Family

gcleaner

C2

gcl-page.biz

194.145.227.161

Targets

    • Target

      e4be75c471d13df766c869ef78e63698_JaffaCakes118

    • Size

      331KB

    • MD5

      e4be75c471d13df766c869ef78e63698

    • SHA1

      96510afbe52c4897b53bf6c9a0a71bd6c4961949

    • SHA256

      9eef2d09ceecb2014ef5fff7ff2fcacbfb7106bcd18bbc1b717d36e898e469d8

    • SHA512

      8280d408e26f282e8686c3199c4b3bb99482abf06e04dc646700e69a2fc3d50f4aeb9dbe7f20239a078eec7749fc920ab12d2b85da50950a97e4405bb2a24491

    • SSDEEP

      3072:lmnOYAZEKVkMRvGzdJW+uB9t+0q1765b20AyrhKD1RHT1I9A2rD0vkjyiOykNScS:lmORZEvm+uPsT76v2D2/rDV2Sc6VRn

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Gcleaner family

    • OnlyLogger

      A tiny loader that uses IPLogger to get its payload.

    • Onlylogger family

    • OnlyLogger payload

MITRE ATT&CK Enterprise v15

Tasks