General

  • Target

    JaffaCakes118_3d551eb09d98f9ece23e7c04db325e97

  • Size

    388KB

  • Sample

    250106-134mpsznct

  • MD5

    3d551eb09d98f9ece23e7c04db325e97

  • SHA1

    c0221f283d861e1441d5ddc6a1ea5eb1964a674f

  • SHA256

    0ed5ea819c1689aaf3017800c99b59c8b10e66cc49ada9b428676348a5c18b18

  • SHA512

    a43c7985ffb604fb74674018ede02d74cf0b8620dba63d94a7f85c8eab075d7a4d3ff2bd4324bb2da5fc3651ff5e582fa4bf99263a99c821d66b75cd8f6f3ba2

  • SSDEEP

    6144:2dTfwYDTggRO4bLVyEOkW6igrunVW9mcvPD93S3yxAv77ykGRDDFa:275LVyEG6i5nVW9D3D93S3yxu75GRd

Malware Config

Extracted

Family

gcleaner

C2

ppp-gl.biz

45.9.20.13

Targets

    • Target

      JaffaCakes118_3d551eb09d98f9ece23e7c04db325e97

    • Size

      388KB

    • MD5

      3d551eb09d98f9ece23e7c04db325e97

    • SHA1

      c0221f283d861e1441d5ddc6a1ea5eb1964a674f

    • SHA256

      0ed5ea819c1689aaf3017800c99b59c8b10e66cc49ada9b428676348a5c18b18

    • SHA512

      a43c7985ffb604fb74674018ede02d74cf0b8620dba63d94a7f85c8eab075d7a4d3ff2bd4324bb2da5fc3651ff5e582fa4bf99263a99c821d66b75cd8f6f3ba2

    • SSDEEP

      6144:2dTfwYDTggRO4bLVyEOkW6igrunVW9mcvPD93S3yxAv77ykGRDDFa:275LVyEG6i5nVW9D3D93S3yxu75GRd

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Gcleaner family

    • OnlyLogger

      A tiny loader that uses IPLogger to get its payload.

    • Onlylogger family

    • OnlyLogger payload

MITRE ATT&CK Enterprise v15

Tasks