General

  • Target

    JaffaCakes118_84cb0a7a8906d09895f74d59950cf353

  • Size

    287KB

  • Sample

    250105-cmjqlaznap

  • MD5

    84cb0a7a8906d09895f74d59950cf353

  • SHA1

    8007fe05481049da7c8d1174c4c6896ea03c9c28

  • SHA256

    8a4d537fe2f4024f45528827497f246b85a568ee6c5b3799736dc4b1d754c87b

  • SHA512

    643fe18d51278b9dae1ffbb4d6e93b0078c0c787aac1ff9994f2eb9f465e5c4a1047863dc79eff1879e544ec1232a79802a4eb05890b8ef019743c648b5f9e22

  • SSDEEP

    6144:X74paROBGiovQXL2X2rYIlMNjgVx98aC3QD:r8akX5bbH8n

Malware Config

Extracted

Family

gcleaner

C2

ppp-gl.biz

45.9.20.13

Targets

    • Target

      JaffaCakes118_84cb0a7a8906d09895f74d59950cf353

    • Size

      287KB

    • MD5

      84cb0a7a8906d09895f74d59950cf353

    • SHA1

      8007fe05481049da7c8d1174c4c6896ea03c9c28

    • SHA256

      8a4d537fe2f4024f45528827497f246b85a568ee6c5b3799736dc4b1d754c87b

    • SHA512

      643fe18d51278b9dae1ffbb4d6e93b0078c0c787aac1ff9994f2eb9f465e5c4a1047863dc79eff1879e544ec1232a79802a4eb05890b8ef019743c648b5f9e22

    • SSDEEP

      6144:X74paROBGiovQXL2X2rYIlMNjgVx98aC3QD:r8akX5bbH8n

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Gcleaner family

    • OnlyLogger

      A tiny loader that uses IPLogger to get its payload.

    • Onlylogger family

    • OnlyLogger payload

MITRE ATT&CK Enterprise v15

Tasks