General

  • Target

    JaffaCakes118_0a69060bb1b7b314a9613c4eb2af33e8be28b0d9ccfcd7a0581288fe43cd05ba

  • Size

    329KB

  • Sample

    241229-jvdb4sxjej

  • MD5

    b0e287b49e8dcda8c13c6485611da3d9

  • SHA1

    b3fdc643db4aa7b1f33120068f3554779bf33654

  • SHA256

    0a69060bb1b7b314a9613c4eb2af33e8be28b0d9ccfcd7a0581288fe43cd05ba

  • SHA512

    daaa678e8297adb99b1081d013447811d2c48a2444c53ff671393dbbf5482e6f34d57484bb61dd6a2afaa1c1636323c39ca2e61adf2b582d916d1ca4616b1ffb

  • SSDEEP

    6144:qM9HlLfe+Oaj1dU9y6WYW+UHr0pqrgSBaYAjmJ:qM9HljjOapdb6i+cIpIlJ

Malware Config

Extracted

Family

gcleaner

C2

45.139.105.171

85.31.46.167

107.182.129.235

171.22.30.106

Attributes
  • url_path

    ....!..../software.php

    ....!..../software.php

Targets

    • Target

      JaffaCakes118_0a69060bb1b7b314a9613c4eb2af33e8be28b0d9ccfcd7a0581288fe43cd05ba

    • Size

      329KB

    • MD5

      b0e287b49e8dcda8c13c6485611da3d9

    • SHA1

      b3fdc643db4aa7b1f33120068f3554779bf33654

    • SHA256

      0a69060bb1b7b314a9613c4eb2af33e8be28b0d9ccfcd7a0581288fe43cd05ba

    • SHA512

      daaa678e8297adb99b1081d013447811d2c48a2444c53ff671393dbbf5482e6f34d57484bb61dd6a2afaa1c1636323c39ca2e61adf2b582d916d1ca4616b1ffb

    • SSDEEP

      6144:qM9HlLfe+Oaj1dU9y6WYW+UHr0pqrgSBaYAjmJ:qM9HljjOapdb6i+cIpIlJ

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Gcleaner family

MITRE ATT&CK Enterprise v15

Tasks