General

  • Target

    JaffaCakes118_f91b4b1f9ebea8c5d30e515cac81a2cf9874a0a9393a822c8c92072150488c9f

  • Size

    336KB

  • Sample

    241224-wt77batkes

  • MD5

    48e7e20416bf3807e4749428e56b49ba

  • SHA1

    95c097242446709a2adfbeb08a250a8fe02cb990

  • SHA256

    f91b4b1f9ebea8c5d30e515cac81a2cf9874a0a9393a822c8c92072150488c9f

  • SHA512

    cff5ac92f6a7b65f2419a864d022a033936183e88c38baa7a9ace6d98fc4adfae1467db3526b9f00f4a0855550ea788914d56e202b3d0cffdcfe4d0f6234ec63

  • SSDEEP

    3072:3RXObGqBsxnBOX15qLkQPzcsVbdwSHBlTB8bLp25uq6oAZ8zcGJPhUdgHcV3RRza:FSGqFyLJzDYSBe2gq6jrMudOcR3

Malware Config

Extracted

Family

gcleaner

C2

45.139.105.171

85.31.46.167

107.182.129.235

171.22.30.106

Attributes
  • url_path

    ....!..../software.php

    ....!..../software.php

Targets

    • Target

      JaffaCakes118_f91b4b1f9ebea8c5d30e515cac81a2cf9874a0a9393a822c8c92072150488c9f

    • Size

      336KB

    • MD5

      48e7e20416bf3807e4749428e56b49ba

    • SHA1

      95c097242446709a2adfbeb08a250a8fe02cb990

    • SHA256

      f91b4b1f9ebea8c5d30e515cac81a2cf9874a0a9393a822c8c92072150488c9f

    • SHA512

      cff5ac92f6a7b65f2419a864d022a033936183e88c38baa7a9ace6d98fc4adfae1467db3526b9f00f4a0855550ea788914d56e202b3d0cffdcfe4d0f6234ec63

    • SSDEEP

      3072:3RXObGqBsxnBOX15qLkQPzcsVbdwSHBlTB8bLp25uq6oAZ8zcGJPhUdgHcV3RRza:FSGqFyLJzDYSBe2gq6jrMudOcR3

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Gcleaner family

MITRE ATT&CK Enterprise v15

Tasks