General

  • Target

    JaffaCakes118_6822bb8ea175ba2ada76d5fee85fefef23d8dfa35c4c36be45eda4330416bcbd

  • Size

    299KB

  • Sample

    241229-rz1bfatncw

  • MD5

    8fa640a44009ffb2c18e1a25a5c4212e

  • SHA1

    f37968c8f6c3c0ade6f2e5b2eac6a5e288b11e53

  • SHA256

    6822bb8ea175ba2ada76d5fee85fefef23d8dfa35c4c36be45eda4330416bcbd

  • SHA512

    06ea277f9747db0de5d37cd46382d0c529a6eaa66234b88782ff9b01b4eb650f76b6f0a032bf5b28fd81ca770d23d2424c58132649a9388628c8939a2903a1fd

  • SSDEEP

    6144:rZOQRI1DHLbWi0mnKPMlpWWG0KTwm6YWTfO/cnKEI9YkwU:rZz2BH/Wi0fkrGdM3qKlI9nl

Malware Config

Extracted

Family

gcleaner

C2

45.139.105.171

85.31.46.167

107.182.129.235

171.22.30.106

Attributes
  • url_path

    ....!..../software.php

    ....!..../software.php

Targets

    • Target

      JaffaCakes118_6822bb8ea175ba2ada76d5fee85fefef23d8dfa35c4c36be45eda4330416bcbd

    • Size

      299KB

    • MD5

      8fa640a44009ffb2c18e1a25a5c4212e

    • SHA1

      f37968c8f6c3c0ade6f2e5b2eac6a5e288b11e53

    • SHA256

      6822bb8ea175ba2ada76d5fee85fefef23d8dfa35c4c36be45eda4330416bcbd

    • SHA512

      06ea277f9747db0de5d37cd46382d0c529a6eaa66234b88782ff9b01b4eb650f76b6f0a032bf5b28fd81ca770d23d2424c58132649a9388628c8939a2903a1fd

    • SSDEEP

      6144:rZOQRI1DHLbWi0mnKPMlpWWG0KTwm6YWTfO/cnKEI9YkwU:rZz2BH/Wi0fkrGdM3qKlI9nl

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Gcleaner family

MITRE ATT&CK Enterprise v15

Tasks